Description
Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
Published: 2026-07-10
Score: 4.2 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Drupal AI Agents is a missing authorization flaw that allows forceful browsing. An attacker can access URLs that should be protected, exposing content that was intended to be hidden. This is a classic authorization bypass (CWE-862) and can lead to the disclosure of confidential information.

Affected Systems

Drupal AI Agents versions 0.0.0 through 1.1.4, 1.2.0 through 1.2.5, and 1.3.0 through 1.3.1 are affected. The issue does not apply to releases beyond 1.3.1.

Risk and Exploitability

The CVSS score of 4.2 indicates moderate severity, while the EPSS score of less than 1 % shows a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is remote web traffic that accesses the vulnerable instance. No special privileges are required to trigger the flaw.

Generated by OpenCVE AI on July 29, 2026 at 09:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Drupal AI Agents to version 1.3.2 or later to apply the missing authorization fix
  • If an upgrade is not immediately possible, restrict access to AI Agents endpoints by requiring authentication and returning 401 or 403 for unauthenticated requests
  • Apply network‑level restrictions to block public traffic to the AI Agents routes until the patch is applied

Generated by OpenCVE AI on July 29, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://www.drupal.org/sa-contrib-2026-056 cve-icon
History

Mon, 13 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Drupal
Drupal ai Agents
Vendors & Products Drupal
Drupal ai Agents

Fri, 10 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.
Title AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056
Weaknesses CWE-862
References

Subscriptions

Drupal Ai Agents
cve-icon MITRE

Status: PUBLISHED

Assigner: drupal

Published:

Updated: 2026-07-13T18:05:21.307Z

Reserved: 2026-06-24T18:00:09.667Z

Link: CVE-2026-13236

cve-icon Vulnrichment

Updated: 2026-07-13T16:33:46.826Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T10:00:15Z

Weaknesses