This vulnerability (CWE-862) in Drupal AI involves missing authorization checks, which could allow an attacker with certain privileges to perform forceful browsing, potentially accessing resources or functions they should not be authorized to use. The affected versions include 0.0.0 through 1.2.17, 1.3.0 through 1.3.8, and 1.4.0 through 1.4.3. The CVSS score of 3.3 indicates a low impact, with network attack vector, high attack complexity, requiring privileges, no user interaction, and limited confidentiality and integrity impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthorized access to certain resources or functions via forceful browsing due to missing authorization checks. The impact is limited to low confidentiality and integrity loss, with no availability impact. Exploitation requires privileges and has high complexity, reducing the likelihood of widespread exploitation. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to affected Drupal AI versions and monitor for unusual access patterns. Avoid granting unnecessary privileges to users to reduce risk.