Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. (CVE-2026-84912)

CVE-2026-84912 describes a missing authorization vulnerability in the Drupal AI (Artificial Intelligence) module that permits forceful browsing. This means that users with limited privileges might bypass intended access controls to view or interact with resources they should not access. The affected versions are from 0.0.0 up to 1.3.13 and from 1.4.0 up to 1.4.8. The CVSS v3.1 base score is 4.6, reflecting a medium severity impact with network attack vector, low attack complexity, requiring privileges, user interaction, and resulting in low confidentiality and integrity impact but no availability impact. There is no information about available patches or vendor advisories, and no known exploits in the wild.

The vulnerability allows unauthorized access to certain resources via forceful browsing, potentially leading to limited confidentiality and integrity impacts. It requires an attacker to have some privileges and user interaction, limiting the scope of exploitation. There is no indication of availability impact or active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to the minimum necessary and monitor for unusual access patterns related to the Drupal AI module. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.