CVE-2026-13235
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The AI (Artificial Intelligence) module for Drupal contains a missing authorization vulnerability that allows forceful browsing, enabling attackers to access unauthorized resources. Affected versions are from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.
Risk Assessment
An attacker can access protected data or functions without proper permissions, potentially leading to information disclosure or unauthorized actions within the Drupal system.
Recommendation
Immediately update the AI module to the latest available version that includes a fix for this vulnerability. Check official Drupal advisories and apply the relevant security patches.
Original NVD description (English source)
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.