Ai Artificial Intelligence EUVD-2026-16391

Remote unauthenticated attacker can exploit Drupal AI module versions 0.0.0–1.1.10 or 1.2.0–1.2.11. No special configuration or victim interaction required. Default installations with vulnerable AI module enabled are affected.

Assessment of real-world risk is constrained by missing CVSS score and vector data, which prevents evaluation of attack vector (network vs. local), attack complexity, and required privileges. However, the CWE-863 classification (authorization failure) combined with resource injection capability indicates a logic-level vulnerability rather than a memory corruption issue, suggesting moderate to high exploitability. The absence of CVSS data, EPSS score, and KEV (CISA Known Exploited Vulnerabilities) status indicates no confirmed active exploitation at time of analysis. Without the CVSS vector, authentication requirements cannot be definitively determined from available data, though authorization bypass vulnerabilities often permit unauthenticated or low-privilege attackers to escalate capabilities. The fact that two distinct version ranges are affected (0.0.0-1.1.11 and 1.2.0-1.2.12) suggests the flaw may span multiple code branches, indicating either a longstanding issue or a regression. Given that vendor patches are available (exact versions identified), this is primarily a patch-adoption risk rather than an uncontrolled exposure.

An attacker with network access to a Drupal installation running a vulnerable version of the AI module could craft a malformed request or manipulate resource parameters to bypass authorization checks. By injecting references to protected AI resources or operations, the attacker could trigger actions (such as querying sensitive data, modifying AI configurations, or invoking restricted AI models) without holding the necessary permissions. This could enable information disclosure, unauthorized modifications, or privilege escalation within the Drupal environment, depending on what resources and operations the AI module exposes.