SmartLinker AI CVE-2026-107307

Exploitation requires a valid authenticated account on the target Drupal site (CVSS PR:L) and that the SmartLinker AI contributed module (version 0.0.0 through 1.0.3) be installed and enabled; the attacker then directly requests a resource whose authorization check is missing or incorrect (forceful browsing). The specific protected resource, role threshold, and configuration that expose the flaw are not described in the available sources. Limiting factors: it is not usable by fully unauthenticated attackers (credentials are required), impact is confined to limited confidentiality disclosure (I and A are not affected), and sites not running this module are unaffected. SSVC marks it not automatable, indicating it is not trivially mass-exploitable.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) describes a remotely reachable flaw requiring low-privilege authentication (PR:L) with only a limited confidentiality impact and no impact to integrity or availability - consistent with an authorization gap (CWE-863, Forceful Browsing) where an already-authenticated user reaches content or endpoints they should not. The independent exploitation signals all point the same direction: EPSS is 0.14% (4th percentile), there is no CISA KEV listing, and SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial. No public exploit reference is present in the input. The vuln.today decision label is 'this_month', i.e. routine scheduled patching rather than an emergency. The one mild tension is that it is network-exploitable yet requires authentication and yields only partial/low technical impact, so raw AV:N overstates the practical danger; there is no conflict between the CVSS vector and the description. Overall this is a real but low-urgency authorization weakness, not a high-impact priority.

An attacker who already holds a low-privileged authenticated account on a Drupal site running the SmartLinker AI module directly requests a resource or endpoint whose access controls are not properly enforced (forceful browsing), viewing data the account is not authorized to see. No public exploit code is referenced, and the specific endpoint and data exposed are not described in the available sources. Because the CVSS vector is AV:N/AC:L, the request can be made remotely over the network with low attack complexity, but it requires valid low-privilege credentials.