EUVD-2026-43059
GHSA-4c7f-qhrm-6jc8
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Network-accessible but PR:H and AC:H because exploitation requires a pre-existing high-privilege session and non-trivial knowledge of unguarded route paths; no availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
6DescriptionCVE.org
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
AnalysisAI
Forceful browsing exposure in Drupal's AI (Artificial Intelligence) contributed module permits high-privileged authenticated users to access protected resources without proper authorization checks, affecting versions 0.0.0-1.2.17, 1.3.0-1.3.8, and 1.4.0-1.4.3. The vulnerability stems from CWE-862 (Missing Authorization), where path-level access controls are not enforced on certain AI module endpoints, allowing an authenticated user with high privileges to traverse to unauthorized resources. No public exploit code exists, EPSS sits at 0.14% (4th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite its network-accessible attack vector.
Technical ContextAI
The affected component is the Drupal AI (Artificial Intelligence) contributed module, identified via CPE cpe:2.3:a:drupal:ai_(artificial_intelligence):*:*:*:*:*:*:*:*. Drupal modules extend the core CMS and are invoked through Drupal's routing and access-control layer; CWE-862 (Missing Authorization) indicates that one or more routes or controller callbacks in this module fail to invoke Drupal's access-checking API before returning data, enabling a logged-in high-privileged principal to reach endpoints they are not entitled to by navigating directly to their URLs - a technique known as forceful browsing. The vulnerability does not require exploiting the authentication subsystem itself; the authentication tag in the intelligence data reflects the authorization bypass outcome rather than a true authentication failure. Because Drupal's access system is opt-in per route, a missing check silently omits enforcement rather than failing closed.
RemediationAI
The vendor has released patched versions addressing this vulnerability; site administrators should upgrade the Drupal AI module to version 1.2.17 (for sites on the 1.2.x branch), 1.3.8 (for the 1.3.x branch), or 1.4.3 (for the 1.4.x branch) per Drupal security advisory SA-contrib-2026-055 available at https://www.drupal.org/sa-contrib-2026-055. Where immediate patching is not possible, a compensating control is to restrict access to the Drupal AI module's administrative and API routes using Drupal's core permission system or web server access controls, limiting those routes to only the roles that genuinely require them; note that this may disrupt legitimate AI module functionality for some roles. Additionally, auditing which high-privileged accounts exist on the installation and reducing their count reduces the effective exposure window given the PR:H requirement.
More in Ai Artificial Intelligence
View allDrupal AI module versions 0.0.0 before 1.1.11 and 1.2.0 before 1.2.12 contain an incorrect authorization vulnerability (
Cross-site scripting in the Drupal AI (Artificial Intelligence) contributed module exposes sites to session hijacking an
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today