EUVD-2026-43061
GHSA-7c7x-54hv-3m8c
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable with no auth required, but high complexity due to path-knowledge prerequisite; limited confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
6DescriptionCVE.org
Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
AnalysisAI
Incorrect Authorization (CWE-863) in the Drupal AI Agents contributed module enables Forceful Browsing, allowing network-reachable attackers to access restricted AI agent resources without proper permission checks. Three distinct release branches are affected: 0.0.0-1.1.4, 1.2.0-1.2.5, and 1.3.0-1.3.1. CISA SSVC classifies exploitation as none with partial technical impact, EPSS sits at the 4th percentile, and no public exploit has been identified at time of analysis - signals that collectively indicate limited immediate real-world risk despite the network-accessible attack vector.
Technical ContextAI
The affected component is the Drupal AI Agents contributed module (CPE: cpe:2.3:a:drupal:ai_agents), which extends the Drupal CMS platform with AI agent orchestration capabilities. CWE-863 (Incorrect Authorization) denotes a failure to verify whether a requesting party holds the necessary permissions before granting access to a resource or operation - distinct from authentication failures (CWE-287), this is an authorization logic defect that occurs after identity resolution. Forceful Browsing exploits this by allowing direct HTTP requests to resource URLs that should be gated behind authorization checks; if those checks are absent or bypassable, the module exposes agent-related resources to callers who should be denied. The AC:H metric in the CVSS vector indicates specific preconditions - such as knowledge of internal resource path structures or identifiers - must be satisfied, suggesting the module's URL scheme or resource naming is a prerequisite for exploitation.
RemediationAI
A patch is available per the vendor advisory at https://www.drupal.org/sa-contrib-2026-057 - administrators should consult that advisory for the exact patched version in their active branch (1.1.x, 1.2.x, or 1.3.x) and upgrade immediately. Exact fixed version numbers are not independently confirmed from the available input data; reference the Drupal security advisory directly for the authoritative fix version per branch. As a compensating control prior to patching, sites can restrict access to AI agent endpoints at the web server or reverse proxy layer by blocking or requiring authentication for paths associated with the AI Agents module's resource routes, though this may degrade agent functionality. Disabling the AI Agents module entirely eliminates the attack surface if the feature is non-critical. Standard Drupal hardening - ensuring the contributed module directory is not publicly writable and that Drupal's permission system is audited - remains relevant context.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today