Missing Authorization Vulnerability in Drupal AI Agents
CVE-2026-13236

4.2MEDIUM

Key Information:

Vendor

Drupal
Status
Ai Agents
Vendor
CVE Published:
10 July 2026

What is CVE-2026-13236?

A missing authorization vulnerability in Drupal AI Agents allows attackers to engage in forceful browsing, potentially accessing unauthorized areas of the application. This affects multiple versions, revealing a critical oversight in access control mechanisms, making it essential for users to review their security configurations.

Affected Version(s)

AI Agents 0.0.0 < 1.1.4

AI Agents 1.2.0 < 1.2.5

AI Agents 1.3.0 < 1.3.1

References

https://www.drupal.org/sa-contrib-2026-056

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kuniyoshi Noguchi (kuninogu)
Artem Dmitriiev (a.dmitriiev)
AKHIL BABU (akhil babu)
harivansh sharma (harivansh)
Kuniyoshi Noguchi (kuninogu)
Marcus Johansson (marcus_johansson)
Bram Driesen (bramdriesen)
.