Drupal AI Translate CVE-2026-84913

Exploitation requires an existing authenticated Drupal account with at least low privileges (CVSS PR:L) on a site running the AI Translate contrib module in affected versions 0.0.0 through 1.3.2 or 1.4.0 through 1.4.1; the flaw is a missing authorization check that permits forceful browsing to AI Translate functionality or resources. Limiting factors: the attacker must already hold a valid low-privilege account (not anonymous/unauthenticated), the supplied vector indicates user interaction is required (UI:R), impact is capped at low confidentiality and integrity with no availability effect, and only sites with the AI Translate module installed are exposed. Updating to the fixed releases (1.3.2 for the pre-1.4 branch, 1.4.1 for the 1.4 branch) per the vendor advisory remediates it.

This is a moderate-severity, low-priority issue rather than an urgent threat. The CVSS 3.1 base score is 4.6 (Medium) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N, meaning network-reachable but requiring existing low-level privileges (PR:L) and some user interaction (UI:R), yielding only low confidentiality and integrity impact and no availability impact - consistent with a Missing Authorization / Forceful Browsing weakness (CWE-862) rather than full compromise. There is NO CISA KEV listing and no EPSS score was provided in the input, so real-world exploitation probability cannot be quantified from the data. The references contain only the Drupal security advisory (SA-contrib-2026-121) and the NVD detail page - neither is PoC or exploit code - so exploitation status is 'no public exploit identified at time of analysis.' The vendor/vuln.today decision label is 'this_month' (not act_now or emergency), reinforcing a planned-patching posture. One minor tension to verify: UI:R in the supplied vector is unusual for forceful browsing, which typically involves an attacker directly requesting unauthorized URLs without victim interaction - confirm the interaction requirement with the vendor advisory. Overall: patch within the normal maintenance cycle; this is a real but bounded authorization-logic flaw, not a high-urgency item.

An authenticated low-privilege Drupal user (PR:L) navigates directly to AI Translate endpoints or routes that lack a proper authorization check, reaching translation functionality or content they should not be able to access or modify. Because impact is limited to low confidentiality and integrity (C:L/I:L, A:N), the attacker can view or alter some translation-related data but cannot fully compromise the site. No public exploit code was identified in the provided sources.