CVE-2026-118550
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
CVE-2026-118550- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-06
EUVDEUVD-2026-113502
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
EUVD-2026-113502- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-jqpj-2gpx-ffr5
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial...
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
GHSA-jqpj-2gpx-ffr5- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-06
NVD
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
CVE-2026-118550- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-06
OSV
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-270
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
CVE-2026-118550- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-525
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-270 No score
This module provides a framework for integrating Drupal with AI providers. Its AI Search submodule provides a Search API backend that stores content in a vector database for semantic search.
The AI Search submodule has always been marked as 'experimental' but more importantly is deprecated. You may wish to use this as an opportunity to move to the standalone AI Search which is a drop-in replacement and target of all new development. It also had the same vulnerability.
The AI Search backend checks access to each search result for the current user, but this is not taken into account when Search API caches the results of a view. As a result, cached search results, including titles and other displayed fields of unpublished or access-restricted content, can be shown to users who do not have access to that content in some configurations.
This vulnerability is mitigated by the fact that:
- The AI Search submodule must be enabled and used with a Search API view.
- The view must use Search API result caching ("Search API (time-based)", "Search API (tag-based)" or "Search API (time and tag-based)"). The default, "Search API (none)", is not affected.
- A user with access to the restricted content must have run the same search within the cache lifetime.
Retrieval-augmented generation (RAG) tools, AI Assistant RAG actions and custom code running Search API queries are not affected.
- Record
DRUPAL-CONTRIB-2026-270- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/aiPackagist:https://packages.drupal.org/8 |
before 1.4.11, 1.5.0 up to 1.5.2 | 1.4.111.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, severity | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118550 is a medium vulnerability (CVSS 5.9) in Drupal Ai (artificial Intelligence), published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in drupal/ai 1.4.11.