{"id":"CVE-2026-114554","kind":"vulnerability","aliases":["CVE-2026-114554"],"related":[],"title":"Drupal AI File to Text: incorrect authorization allows forceful browsing","description":"Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.","summary":"The Drupal AI File to Text module has an incorrect authorization flaw that lets a user reach content by forceful browsing. An attacker can reach resources they should not be able to view, according to the advisory description.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-file-to-text","drupal","package","php"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check whether the `ai_file_to_text` module is installed on the Drupal site, for example with `drush pm:list --filter=ai_file_to_text`.\n- Confirm the installed module version against the affected range (0.0.0 to 1.0.1).","fix":null,"status":"open","published_at":"2026-10-30T04:18:16+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","triaged_at":"2026-10-30T04:29:44+00:00","updated_at":"2026-10-30T04:29:44+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-30T04:29:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Drupal AI File to Text: incorrect authorization allows forceful browsing","impact":"medium","summary":"The Drupal AI File to Text module has an incorrect authorization flaw that lets a user reach content by forceful browsing. An attacker can reach resources they should not be able to view, according to the advisory description.","audience":"businesses","category":"package","nicknames":[],"who_cares":["drupal","php","ai-file-to-text"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to restricted resources through direct URL requests","analyst_note":"Check the Drupal security advisory for the affected endpoints, required permissions, and the fixed version beyond 1.0.1.","how_to_check":"- Check whether the `ai_file_to_text` module is installed on the Drupal site, for example with `drush pm:list --filter=ai_file_to_text`.\n- Confirm the installed module version against the affected range (0.0.0 to 1.0.1).","plain_action":"","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Drupal sites that run the AI File to Text module in the affected version range. The sources do not say which endpoints are exposed or what data they return, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000658,"input_tokens":4081,"output_tokens":500,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114554':13A,16A '-2026':12A,15A '0.0.0':84C '1.0.1':86C 'abl':55B 'accord':58B 'advisori':61B 'affect':77C 'ai':2A,18B,27B,68C,78C 'ai-file-to-text':17B 'allow':8A,72C 'attack':47B 'author':7A,35B,64C 'brows':10A,45B,74C 'content':42B 'cve':11A,14A 'descript':62B 'drupal':1A,22B,26B,67C 'file':3A,19B,28B,69C,79C 'flaw':36B 'forc':9A,44B,73C 'incorrect':6A,34B,63C 'issu':76C 'let':38B 'modul':31B 'packag':23B 'php':24B 'reach':41B,49B 'resourc':50B 'text':5A,21B,30B,71C,81C 'user':40B 'version':82C 'view':57B 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Drupal sites that run the AI File to Text module in the affected version range. The sources do not say which endpoints are exposed or what data they return, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T04:18:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114554","severity":null,"published_at":"2026-10-30T04:18:16+00:00","modified_at":"2026-10-30T04:18:16+00:00","first_seen_at":"2026-10-30T04:28:37+00:00","fetched_at":"2026-10-30T04:28:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}