Drupal ImageAPI Optimize WebP is vulnerable to the use of Web Browser Cache containing sensitive information and incorrectly configured access control security levels. The flaw can cause an attacker to read or exfiltrate sensitive data stored in a browser’s cache when accessing WebP optimized images, leading to disclosure of confidential content. The vulnerability arises from flawed caching behavior that permits unintended data exposure without proper authentication or authorization checks.

The affected product is Drupal ImageAPI Optimize WebP. Versions from 0.0.0 through 2.1.2 are impacted. Users running any of these releases should verify their installation version and be prepared to apply an update.

The vulnerability carries a moderate risk of information disclosure, is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score is available. Since the CVE description references incorrectly configured access controls and browser cache exposure, the likely attack path involves a web‑based request to the image optimization endpoint that retrieves cached data; however, the exact access vector is not explicitly stated and is inferred from the stated weakness. Because no exploit probability data or severity score is provided, the risk assessment relies on the moderate moderation noted in the advisory and the potential for sensitive data exposure.