Drupal AI EUVD-2026-107879

Exploitation requires a valid authenticated account with at least low privileges (PR:L) on a Drupal site running the AI (Artificial Intelligence) module in an affected range (0.0.0 through 1.3.13-exclusive, or 1.4.0 through 1.4.8-exclusive). The flaw is a missing authorization check that permits forceful browsing - directly accessing a resource or endpoint that should be access-controlled. Limiting factors: an attacker cannot exploit this anonymously (authentication is required), impact is capped at partial confidentiality and integrity with no availability effect, and the CVSS vector indicates some user interaction (UI:R) is involved, though the sources do not describe what that interaction is. The specific endpoint, feature, or configuration that is left unprotected is not detailed in the available description.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Drupal AI contrib module, scored CVSS 4.6. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) indicates a network-reachable issue that requires an authenticated low-privileged account (PR:L) and some user interaction (UI:R), with only low confidentiality and integrity impact and no availability impact. The vuln.today decision label is 'this_month' rather than act_now/emergency, which is consistent with the limited impact and the authentication prerequisite. No EPSS score, no CISA KEV listing, and no proof-of-concept or exploit reference were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. One internal inconsistency to verify: the module description characterizes the flaw as 'Forceful Browsing' (direct unauthorized access to resources), which typically needs no user interaction, yet the supplied CVSS vector sets UI:R - the role of user interaction is not explained in the available sources and should be confirmed with the Drupal advisory. Overall this is a real but lower-tier priority: it requires a valid account, yields only partial read/write exposure of resources, and shows none of the amplifying signals (KEV, high EPSS, automatable exploitation) that would make it urgent.

An attacker who already holds a low-privileged authenticated account on a Drupal site running a vulnerable AI module version navigates directly to a resource or endpoint that lacks a proper authorization check, gaining access to data or actions beyond their assigned permissions. Because impact is limited to low confidentiality and integrity (C:L/I:L), the result is partial unauthorized disclosure or modification rather than full site compromise. No public exploit code was identified in the provided data.