DRUPAL-CONTRIB-2026-247: ImageAPI Optimize WebP - Moderately critical - Information disclosure - SA-CONTRIB-2026-247
Published Oct 30, 2026
·Updated
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2.
Affected Software
1 affected component
Drupal ImageAPI Optimize WebP>=0.0.0<=2.1.2
Event History
Oct 30, 2026
CVE Published
via OSV·03:09 AM
Data Sourced
via OSV·03:09 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Drupal sites using ImageAPI Optimize WebP versions from 0.0.0 through 2.1.2 are affected.
2
Does exploitation require an authenticated account or user interaction?
No. The supplied vector indicates network-reachable exploitation with no privileges or user interaction required, although attack complexity is rated high.
3
What impact is indicated?
The issue is an information disclosure vulnerability involving web browser caching of sensitive information. The provided impact assessment indicates low confidentiality impact and no integrity or availability impact.