{"id":"CVE-2026-84912","aliases":["DRUPAL-CONTRIB-2026-120","EUVD-2026-107879","GHSA-c487-5f4x-cmc3"],"status":"published","title":"AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00188,"percentile":0.08536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2026-09-02T16:27:29Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","fixed_in":["1.3.13","1.4.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.13"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.8"}]}]}],"products":[{"vendor":"drupal","product":"ai (artificial intelligence)"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2026-120","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84912","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c487-5f4x-cmc3"},{"url":"https://git.drupalcode.org/project/ai","tags":["web"]},{"url":"https://www.drupal.org/project/ai","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84912.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-84912","title":"AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","status":"published","published":"2026-10-22T01:22:16.899Z","modified":"2026-10-22T13:49:28.251Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:08.391556Z"}],"euvd":[{"id":"EUVD-2026-107879","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","status":"published","published":"2026-10-22T01:22:16Z","modified":"2026-10-22T13:49:28Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:35.198677Z"}],"ghsa":[{"id":"GHSA-c487-5f4x-cmc3","title":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful...","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","status":"published","published":"2026-10-22T03:33:38Z","modified":"2026-10-22T15:32:42Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:14:15.712154Z"}],"nvd":[{"id":"CVE-2026-84912","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","status":"published","published":"2026-10-22T02:17:01.607Z","modified":"2026-10-22T16:54:17.39Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:13:02.371082Z"}],"osv":[{"id":"CVE-2026-84912","title":"AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120","description":"Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.3.13, from 1.4.0 to 1.4.8.","status":"published","published":"2026-10-22T01:22:16.899Z","modified":"2026-10-28T02:31:14.007007026Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DRUPAL-CONTRIB-2026-120","description":"This submodule AI Translate enables you to automatically translate entities.\n\nThe module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the parent entity. This permission bypass is only applicable to the translate operation - no unwarranted read or update access is granted to the affected entities","status":"published","published":"2026-09-02T16:27:29Z","modified":"2026-09-02T19:55:50.250263Z","updated_at":"2026-11-02T15:46:13.900249Z"}]}}