First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-118550

MediumCVSS 5.9/10Last modified Nov 6, 2026

Description

Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Drupal	AI (Artificial Intelligence)	>= 0.0.0, < 1.4.11; >= 1.5.0, < 1.5.2

References

https://www.drupal.org/sa-contrib-2026-270

Timeline

Published: Oct 30, 2026
Last modified: Nov 6, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1185513.1Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This CVE-2026-1185526.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) al CVE-2026-1185535.5Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) al CVE-2026-1185545.4Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This is CVE-2026-1185556.3Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: fro CVE-2026-1185566.5Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: f CVE-2026-1185572.7Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: f CVE-2026-1185587.3Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Stripe allows Cross Site Request Forgery. This issue affects Commerce Str CVE-2026-1185595.3Improper Verification of Cryptographic Signature vulnerability in Drupal Commerce Stripe allows Signature Spoof. This issue affects Commerce CVE-2026-118569.8Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin CVE-2026-1185605.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce Stripe allows Cross-Si CVE-2026-1185617.2External Control of File Name or Path vulnerability in Drupal Single Content Sync allows Path Traversal. This issue affects Single Content S

CVE-2026-118550: Medium severity, CVSS 5.9 | Vulnix