Missing Authorization Vulnerability in Drupal AI Software
CVE-2026-84912

4.6MEDIUM

Key Information:

Vendor

Drupal
Status
Ai (artificial Intelligence)
Vendor
CVE Published:
22 October 2026

What is CVE-2026-84912?

A missing authorization vulnerability in Drupal AI allows unauthorized users to access restricted resources through forceful browsing. This can lead to the exposure of sensitive information or unauthorized actions by malicious users. Affected versions range from 0.0.0 to 1.3.13 and 1.4.0 to 1.4.8, necessitating prompt attention from users to secure their installations.

Affected Version(s)

AI (Artificial Intelligence) 0.0.0 < 1.3.13

AI (Artificial Intelligence) 1.4.0 < 1.4.8

References

https://www.drupal.org/sa-contrib-2026-120

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Artem Dmitriiev (a.dmitriiev)
Marcus Johansson (marcus_johansson)
Sven Decabooter (svendecabooter)
Valery Lourie (valthebald)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
.