{"id":"CVE-2026-118548","aliases":["DRUPAL-CONTRIB-2026-268","EUVD-2026-113504","GHSA-526v-6mxg-q55q"],"status":"published","title":"AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268","description":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00197,"percentile":0.09534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-10-28T17:09:05Z","modified":"2026-11-06T12:56:47Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","fixed_in":["1.4.11","1.5.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}]}],"products":[{"vendor":"drupal","product":"ai (artificial intelligence)"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-268","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118548","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-526v-6mxg-q55q"},{"url":"https://git.drupalcode.org/project/ai","tags":["web"]},{"url":"https://www.drupal.org/project/ai","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118548.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118548","title":"AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268","description":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T03:08:58.257Z","modified":"2026-11-06T12:56:47.851Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-113504","description":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T03:08:58Z","modified":"2026-11-06T12:56:47Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-06T14:05:02.958369Z"}],"ghsa":[{"id":"GHSA-526v-6mxg-q55q","title":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource...","description":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T06:31:58Z","modified":"2026-11-06T15:31:19Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:39.918673Z"}],"nvd":[{"id":"CVE-2026-118548","description":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T04:18:19.96Z","modified":"2026-11-06T13:17:26.68Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-06T16:00:35.469074Z"}],"osv":[{"id":"CVE-2026-118548","title":"AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268","description":"Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.","status":"published","published":"2026-10-30T03:08:58.257Z","modified":"2026-11-08T02:30:45.721282328Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-07T03:08:01.41647Z"},{"id":"DRUPAL-CONTRIB-2026-268","description":"This module enables you to use AI on the website. It also enables you to interact with AI providers.\n\nThe module does not sufficiently validate links under certain conditions, potentially allowing the exfiltration of sensitive information to external sites.\n\nThis vulnerability is mitigated by the fact that an attacker must use untrusted sources when interacting with the AI module in a way that produces rendered HTML.","status":"published","published":"2026-10-28T17:09:05Z","modified":"2026-10-28T18:15:02.348525438Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}