{"id":"CVE-2026-84912","kind":"vulnerability","aliases":["CVE-2026-84912"],"related":[],"title":"Drupal AI module: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","summary":"The Drupal AI (Artificial Intelligence) module fails to check authorization on some routes, so a user can reach pages they should not see by browsing directly to their URLs. The sources do not say what data those pages expose.","severity":"medium","cvss":4.6,"epss":0.00148,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed AI module version with `drush pm:list --filter=ai` or `composer show drupal/ai`\n- Treat versions up to `1.3.13` and `1.4.0` through `1.4.8` as affected\n- unknown","fix":"- Upgrade the Drupal AI module to a release later than `1.3.13` (for the 1.3 line) or later than `1.4.8` (for the 1.4 line)\n- unknown","status":"open","published_at":"2026-10-22T02:17:01+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:35:32+00:00","updated_at":"2026-10-25T04:35:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:35:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal AI module to a release later than `1.3.13` (for the 1.3 line) or later than `1.4.8` (for the 1.4 line)\n- unknown","reach":"internet","title":"Drupal AI module: missing authorization lets users browse restricted pages","impact":"low","summary":"The Drupal AI (Artificial Intelligence) module fails to check authorization on some routes, so a user can reach pages they should not see by browsing directly to their URLs. The sources do not say what data those pages expose.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized users can view restricted AI module pages and their data.","analyst_note":"Find the Drupal security advisory for the AI module to confirm which routes are affected and what data they expose.","how_to_check":"- Check the installed AI module version with `drush pm:list --filter=ai` or `composer show drupal/ai`\n- Treat versions up to `1.3.13` and `1.4.0` through `1.4.8` as affected\n- unknown","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal AI module in the affected version ranges are exposed, most likely where the module's pages are reachable by users without the right permissions. Sites not using the AI module can skip it. The sources do not say which specific routes are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3354,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-84912':13A,16A '0.0.0':81C '1.3.13':83C '1.4.0':85C '1.4.8':87C 'affect':75C 'ai':2A,25B,67C,76C 'allow':70C 'artifici':26B,68C,77C 'author':5A,32B,63C 'brows':8A,47B,72C 'check':31B 'cve':11A,14A 'data':58B 'direct':48B 'drupal':1A,17B,24B,66C 'expos':61B 'fail':29B 'forc':71C 'host':22B 'intellig':27B,69C,78C 'issu':74C 'let':6A 'miss':4A,62C 'modul':3A,28B 'packag':18B 'page':10A,41B,60B 'php':19B 'reach':40B 'restrict':9A 'rout':35B 'say':56B 'see':45B 'self':21B 'self-host':20B 'sourc':53B 'url':51B 'user':7A,38B 'version':79C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal AI module in the affected version ranges are exposed, most likely where the module's pages are reachable by users without the right permissions. Sites not using the AI module can skip it. The sources do not say which specific routes are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84912","severity":null,"published_at":"2026-10-22T02:17:01+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84912","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84912","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}