CVE-2026-13235
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The AI (Artificial Intelligence) module for Drupal contains a missing authorization vulnerability that allows forceful browsing, enabling attackers to access unauthorized resources. Affected versions are from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, and from 1.4.0 to 1.4.3.
Risk Assessment
An attacker can access protected data or functions without proper permissions, potentially leading to information disclosure or unauthorized actions within the Drupal system.
Recommendation
Immediately update the AI module to the latest available version that includes a fix for this vulnerability. Check official Drupal advisories and apply the relevant security patches.
Other vulnerabilities in Drupal AI (Artificial Intelligence)
See all- CVE-2026-118553Low risk· EPSS 6%
The Drupal AI (Artificial Intelligence) module has an improper neutralization of input during web page generation vulnerability, enabling Stored XSS attacks. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-118552Low risk· EPSS 6%
The Drupal AI (Artificial Intelligence) module contains an improper neutralization of input during web page generation vulnerability, enabling Cross-Site Scripting (XSS) attacks. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-118551Low risk· EPSS 4%
The Drupal AI (Artificial Intelligence) module stores sensitive information insecurely, allowing retrieval of embedded sensitive data. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-118550Low risk· EPSS 9%
The Drupal AI (Artificial Intelligence) module uses web browser cache containing sensitive information, allowing exploitation of incorrectly configured access control security levels. This issue affects versions from 0.0.0 to 1.4.11 and from 1.5.0 to 1.5.2.
- CVE-2026-84912Medium
Missing Authorization vulnerability in the Drupal AI (Artificial Intelligence) module allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.
- CVE-2026-84911Low
A Stored Cross-Site Scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) module arises from improper neutralization of input during web page generation. The issue affects versions from 0.0.0 to 1.3.13 and from 1.4.0 to 1.4.8.
- CVE-2025-31693Medium
An OS command injection vulnerability was found in the AI (Artificial Intelligence) module for Drupal. The flaw affects versions before 1.0.5 and allows an attacker to execute arbitrary commands on the server.
Original NVD description (English source)
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS