The vulnerability in Drupal Media Alias Display arises from the improper handling of web browser cache that contains sensitive information. Due to incorrectly configured access control security levels, an attacker can expose confidential data that the cache holds. This weakness aligns with CWE-525, representing a sensitive data exposure that can lead to the leakage of private user or system information.

Drupal Media Alias Display versions from 0.0.0 through 2.1.2, and from 3.0.0 through 3.0.2 are affected. These versions are deployed on Drupal installations where the Media Alias Display module is enabled and improperly secured accesses are permitted.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation data. Based on the description, the likely attack vector is via web access to the Media Alias Display component, potentially by any user that can request alias pages. If access control is misconfigured, an unauthorized user may read cached data; a privileged user could view a broader set of aliases. Exploitation could be straightforward for attackers who can reach the affected URLs, but no specific exploit code or proof‑of‑concepts are documented in the available references.