CVE-2026-118550

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.4.11 Drupal AI versions 1.5.0 through 1.5.2

Description Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

Recommendations For versions 0.0.0 through 1.4.11 and 1.5.0 through 1.5.2, disable the use of Search API result caching by setting it to Search API (none). Restrict the use of the AI Search submodule until a fix is applied.