CVE-2026-84912: AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
Published Oct 22, 2026
·Updated
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
Affected Software
1 affected component
Drupal AI (Artificial Intelligence)>=0.0.0<=1.3.13, >=1.4.0<=1.4.8
Event History
Oct 22, 2026
CVE Published
via MITRE·01:22 AM
Data Sourced
via MITRE·01:22 AM
DescriptionWeakness
Data Sourced
via NVD·02:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which releases are affected?
Affected releases are 0.0.0 through 1.3.13 and 1.4.0 through 1.4.8. The provided information does not identify an affected Drupal core version or a fixed release.
2
What type of access control weakness is involved?
The issue is a missing-authorization flaw that allows forceful browsing. This means an attacker may be able to access functionality or resources by directly requesting them when authorization checks are absent.