CVE-2026-118548
AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
CVE-2026-118548- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
EUVDEUVD-2026-113504
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
EUVD-2026-113504- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-526v-6mxg-q55q
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource...
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
GHSA-526v-6mxg-q55q- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
NVD
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
CVE-2026-118548- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-06
OSV
AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
- Record
CVE-2026-118548- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-07
OSVDRUPAL-CONTRIB-2026-268 No score
This module enables you to use AI on the website. It also enables you to interact with AI providers.
The module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites.
This vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML.
- Record
DRUPAL-CONTRIB-2026-268- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/aiPackagist:https://packages.drupal.org/8 |
before 1.4.11, 1.5.0 up to 1.5.2 | 1.4.111.5.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts, severity | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-118548 is a low vulnerability (CVSS 3.7) in Drupal Ai (artificial Intelligence), published October 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/ai 1.4.11.