Threats tagged 'drupal-contrib-2026-270'

The Drupal AI module's AI Search submodule has a vulnerability where cached search results may expose titles and fields of unpublished or access-restricted content to unauthorized users under certain configurations. This occurs because the Search API caches results without considering access restrictions, potentially leaking sensitive content. The vulnerability only affects setups using the AI Search submodule with Search API result caching enabled and requires that a user with access to restricted content has previously run the same search within the cache lifetime. Retrieval-augmented generation tools and custom Search API queries are not affected. Fixed versions 1.4.11 and 1.5.2 address this issue.