Live › vulnerability › CVE-2026-114554
The Drupal AI File to Text module has an incorrect authorization flaw that lets a user reach content by forceful browsing. An attacker can reach resources they should not be able to view, according to the advisory description.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 04:28 UTC. All times on this page are UTC.
Drupal sites that run the AI File to Text module in the affected version range. The sources do not say which endpoints are exposed or what data they return, so the exact exposure is unknown.
No product ranges from the sources yet.
ai_file_to_text module is installed on the Drupal site, for example with drush pm:list --filter=ai_file_to_text.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-114554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.