This vulnerability (CVE-2026-3573) in Drupal AI arises from incorrect authorization (CWE-863), which permits resource injection attacks. Affected versions include 0.0.0 up to but not including 1.1.11, and 1.2.0 up to but not including 1.2.12. The CVSS 3.1 vector indicates the vulnerability is remotely exploitable without privileges or user interaction, and it results in a high confidentiality impact without affecting integrity or availability. No patch or official fix information is provided in the data, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could allow an attacker to inject resources due to improper authorization checks, potentially leading to unauthorized access to sensitive information (high confidentiality impact). There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Drupal vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Drupal security advisories for updates addressing this vulnerability. Until a fix is available, restricting access to the affected Drupal AI module and minimizing exposure may reduce risk.