Drupal AI (Artificial Intelligence) suffers a missing authorization check that allows attackers to inject resources and view sensitive data they are not permitted to access. This flaw can lead to the disclosure of confidential information and may enable attackers to gather additional context for further attacks. The weakness maps to CWE‑863, an authorization error that permits illicit resource access.

The vulnerability affects the Drupal AI (Artificial Intelligence) module. All releases from the initial 0.0.0 build up to before 1.1.11 and from 1.2.0 up to before 1.2.12 are impacted.

With a CVSS score of 7.5, the flaw is considered moderately severe. The EPSS score of less than 1% indicates low current exploitation probability, and the issue is not listed in the CISA KEV catalog. The likely attack vector is via unauthorized web requests to the AI module’s endpoints, exploiting the missing authorization safeguard. Mitigation requires applying the vendor‑issued patch or upgrading to a version beyond 1.1.11 or 1.2.12 to eliminate the flaw.