Missing Authorization Vulnerability in Drupal AI Software
CVE-2026-84912

Currently unrated

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84912?

A missing authorization vulnerability in Drupal AI allows unauthorized users to access restricted resources through forceful browsing. This can lead to the exposure of sensitive information or unauthorized actions by malicious users. Affected versions range from 0.0.0 to 1.3.13 and 1.4.0 to 1.4.8, necessitating prompt attention from users to secure their installations.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.3.13

AI (Artificial Intelligence) 1.4.0 < 1.4.8

References

https://www.drupal.org/sa-contrib-2026-120

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Marcus Johansson (marcus_johansson)
Sven Decabooter (svendecabooter)
Valery Lourie (valthebald)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.