{"id":"CVE-2025-31678","aliases":["DRUPAL-CONTRIB-2025-004","EUVD-2025-9045","GHSA-c8q6-wp7v-46r9"],"status":"published","title":"AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00381,"percentile":0.32528,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2025-01-22T16:50:12Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"Packagist","package":"drupal/ai","fixed_in":["1.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","fixed_in":["1.0.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3"}]}]}],"products":[{"vendor":"artificial_intelligence_project","product":"artificial_intelligence"},{"vendor":"drupal","product":"ai (artificial intelligence)"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2025-004","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31678","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c8q6-wp7v-46r9"},{"url":"https://git.drupalcode.org/project/ai","tags":["web","package"]},{"url":"https://www.drupal.org/project/ai","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31678.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-31678","title":"AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","status":"published","published":"2025-03-31T21:38:07.302Z","modified":"2025-04-29T15:40:38.758Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-9045","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","status":"published","published":"2025-03-31T21:38:07Z","modified":"2025-04-29T15:40:38Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:00.449871Z"}],"ghsa":[{"id":"GHSA-c8q6-wp7v-46r9","title":"Drupal AI Missing Authorization vulnerability","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","status":"published","published":"2025-04-01T00:30:33Z","modified":"2025-04-29T20:17:48Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2025-31678","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","status":"published","published":"2025-03-31T22:15:20.33Z","modified":"2026-06-17T09:10:45.357Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:10:56.494516Z"}],"osv":[{"id":"CVE-2025-31678","title":"AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","status":"published","published":"2025-03-31T21:38:07.302Z","modified":"2026-10-28T02:31:01.673781624Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:48.02508Z"},{"id":"GHSA-c8q6-wp7v-46r9","title":"Drupal AI Missing Authorization vulnerability","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.","status":"published","published":"2025-04-01T00:30:33Z","modified":"2025-12-10T23:41:13.011541Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","level":"high"},{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"DRUPAL-CONTRIB-2025-004","description":"The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes.\n\nThe module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged.\n\nThis vulnerability is mitigated by the fact that it only affects sites using the AI Logging sub-module with 'Log requests' enabled in the AI Logging configuration page.","status":"published","published":"2025-01-22T16:50:12Z","modified":"2026-09-10T03:45:12.224904362Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}