CVE-2026-118571

Name of the Vulnerable Software and Affected Versions Media Alias Display versions 0.0.0 through 2.1.3 Media Alias Display versions 3.0.0 through 3.0.3

Description Incorrectly configured access control security levels allow the use of web browser cache containing sensitive information. Files may be served with the Cache-Control: public HTTP header when they should be uncacheable, potentially allowing users to access cached versions of files containing information they are not authorized to see. This occurs when a more-privileged user has previously requested the file and it remains in the cache.

Recommendations Update Media Alias Display versions 0.0.0 through 2.1.3 to a version newer than 2.1.3. Update Media Alias Display versions 3.0.0 through 3.0.3 to a version newer than 3.0.3. Configure Drupal to handle non-public files using a custom or contributed module that provides an additional file scheme.