Smartlinker Ai
Monthly
SmartLinker AI, a contributed Drupal module, ships an incorrect authorization check (CWE-863) that permits forceful browsing: an authenticated user can directly request resources they should not be allowed to reach, resulting in limited information disclosure. Versions 0.0.0 through 1.0.3 are affected, and only sites with the module installed and enabled are exposed; the CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms credentials are required and that integrity and availability impacts are absent. No public exploit code has been identified at time of analysis, EPSS is 0.14% (4th percentile), and CISA SSVC records exploitation as none with automation as not possible, so this is a low-priority item to schedule for a normal maintenance window rather than an emergency.
SmartLinker AI, a contributed Drupal module, ships an incorrect authorization check (CWE-863) that permits forceful browsing: an authenticated user can directly request resources they should not be allowed to reach, resulting in limited information disclosure. Versions 0.0.0 through 1.0.3 are affected, and only sites with the module installed and enabled are exposed; the CVSS score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms credentials are required and that integrity and availability impacts are absent. No public exploit code has been identified at time of analysis, EPSS is 0.14% (4th percentile), and CISA SSVC records exploitation as none with automation as not possible, so this is a low-priority item to schedule for a normal maintenance window rather than an emergency.