CVE-2026-13235 - Vulnerability Details - OpenCVE

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Drupal	Artificial Intelligence

No data.

No data.

References

Link	Providers
https://www.drupal.org/sa-contrib-2026-055

History

Mon, 13 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`	cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 13 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 13 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Drupal Drupal artificial Intelligence
Vendors & Products		Drupal Drupal artificial Intelligence

Fri, 10 Jul 2026 22:00:00 +0000

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.
Title		AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
Weaknesses		CWE-862
References		https://www.drupal.org/sa-contrib-2026-055

MITRE

Status: PUBLISHED

Assigner: drupal

Published: 2026-07-10T21:44:41.284Z

Updated: 2026-07-13T18:06:50.932Z

Reserved: 2026-06-24T18:00:08.720Z

Link: CVE-2026-13235

Vulnrichment

Updated: 2026-07-13T16:34:31.855Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13235", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "state": "PUBLISHED", "assignerShortName": "drupal", "dateReserved": "2026-06-24T18:00:08.720Z", "datePublished": "2026-07-10T21:44:41.284Z", "dateUpdated": "2026-07-13T18:06:50.932Z"}, "containers": {"cna": {"title": "AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055", "datePublic": "2026-06-24T18:37:45.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-055"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "CWE-862 Missing Authorization", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"collectionURL": "https://www.drupal.org/project/ai", "product": "AI (Artificial Intelligence)", "vendor": "Drupal", "repo": "https://git.drupalcode.org/project/ai", "versions": [{"lessThan": "1.2.17", "status": "affected", "version": "0.0.0", "versionType": "semver"}, {"lessThan": "1.3.8", "status": "affected", "version": "1.3.0", "versionType": "semver"}, {"lessThan": "1.4.3", "status": "affected", "version": "1.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3."}], "credits": [{"lang": "en", "type": "finder", "value": "AKHIL BABU (akhil babu)"}, {"lang": "en", "type": "finder", "value": "Kuniyoshi Noguchi (kuninogu)"}, {"lang": "en", "type": "remediation developer", "value": "Artem Dmitriiev (a.dmitriiev)"}, {"lang": "en", "type": "remediation developer", "value": "Marcus Johansson (marcus_johansson)"}, {"lang": "en", "type": "remediation developer", "value": "Dezs\u00c5\u0091 Bicz\u00c3\u00b3 (mxr576)"}, {"lang": "en", "type": "remediation developer", "value": "Valery Lourie (valthebald)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-07-10T21:44:41.284Z"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:06:25.605894Z", "id": "CVE-2026-13235", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:06:50.932Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-13235", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:06:25.605894Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T16:34:31.855Z"}}], "cna": {"title": "AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055", "credits": [{"lang": "en", "type": "finder", "value": "AKHIL BABU (akhil babu)"}, {"lang": "en", "type": "finder", "value": "Kuniyoshi Noguchi (kuninogu)"}, {"lang": "en", "type": "remediation developer", "value": "Artem Dmitriiev (a.dmitriiev)"}, {"lang": "en", "type": "remediation developer", "value": "Marcus Johansson (marcus_johansson)"}, {"lang": "en", "type": "remediation developer", "value": "Dezs\u00c5\u0091 Bicz\u00c3\u00b3 (mxr576)"}, {"lang": "en", "type": "remediation developer", "value": "Valery Lourie (valthebald)"}, {"lang": "en", "type": "coordinator", "value": "Bram Driesen (bramdriesen)"}, {"lang": "en", "type": "coordinator", "value": "Greg Knaddison (greggles)"}, {"lang": "en", "type": "coordinator", "value": "Drew Webber (mcdruid)"}, {"lang": "en", "type": "coordinator", "value": "Juraj Nemec (poker10)"}], "impacts": [{"capecId": "CAPEC-87", "descriptions": [{"lang": "en", "value": "CAPEC-87 Forceful Browsing"}]}], "affected": [{"repo": "https://git.drupalcode.org/project/ai", "vendor": "Drupal", "product": "AI (Artificial Intelligence)", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "1.2.17", "versionType": "semver"}, {"status": "affected", "version": "1.3.0", "lessThan": "1.3.8", "versionType": "semver"}, {"status": "affected", "version": "1.4.0", "lessThan": "1.4.3", "versionType": "semver"}], "collectionURL": "https://www.drupal.org/project/ai"}], "datePublic": "2026-06-24T18:37:45.000Z", "references": [{"url": "https://www.drupal.org/sa-contrib-2026-055"}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "shortName": "drupal", "dateUpdated": "2026-07-10T21:44:41.284Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13235", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:06:50.932Z", "dateReserved": "2026-06-24T18:00:08.720Z", "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387", "datePublished": "2026-07-10T21:44:41.284Z", "assignerShortName": "drupal"}, "dataVersion": "5.2"}