Live › vulnerability › CVE-2026-84912
Go to dashboardThe Drupal AI (Artificial Intelligence) module fails to check authorization on some routes, so a user can reach pages they should not see by browsing directly to their URLs. The sources do not say what data those pages expose.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal AI module in the affected version ranges are exposed, most likely where the module's pages are reachable by users without the right permissions. Sites not using the AI module can skip it. The sources do not say which specific routes are affected.
No product ranges from the sources yet.
drush pm:list --filter=ai or composer show drupal/ai1.3.13 and 1.4.0 through 1.4.8 as affected1.3.13 (for the 1.3 line) or later than 1.4.8 (for the 1.4 line)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.
This page as .md · .json · in your agent: get_signal("CVE-2026-84912")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.