Executive brief
DXPR Builder is a visual page-builder module for Drupal that enables content creation and AI-powered features. The module improperly exposes API tokens and licensing credentials in JavaScript settings accessible to all website visitors, including anonymous users. An attacker can harvest these tokens to gain unauthorized access to AI services, licensing systems, and subscription data, potentially incurring costs or accessing premium features without authorization.
Technical details
The vulnerability is an information disclosure flaw in DXPR Builder 2.x where JSON Web Tokens (JWTs) used for licensing, AI services, and subscription management are insufficiently restricted and exposed via drupalSettings in page JavaScript. The root cause is the module's failure to properly control access to sensitive credential data in frontend code. The attack vector is passive reconnaissance requiring only network access and no authentication—an unauthenticated attacker can view page source or inspect JavaScript to extract the exposed token. When AI agent features are enabled and configured with an API token, all site visitors can retrieve this credential. The 2.8.1 patch restricts access to these credentials, and the 3.x branch mitigates the issue by proxying AI requests through a separate contributed module.
Affected products
- Acquia DXPR Builder 2.0.0 to 2.8.0
Timeline
- 2026-08-26: disclosed: Security advisory SA-CONTRIB-2026-112 published
- 2026-08-26: patched: DXPR Builder 2.8.1 released with fix