CVE-2026-13235

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13235
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13235.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13235
Aliases
Published
2026-07-10T21:44:41.284Z
Modified
2026-08-12T03:51:33.819529213Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
AI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-055
Details

Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.2.17, from 1.3.0 to 1.3.8, from 1.4.0 to 1.4.3.

Database specific 
{
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13235.json",
    "cna_assigner": "drupal"
}
References

Affected packages

Git / git.drupalcode.org/project/ai

Affected ranges

Type
GIT
Repo
https://git.drupalcode.org/project/ai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eadb7fc89d8004f93815ad64056d736171291415
Introduced
aaa34ba25c37753aaa5d8e56e051f3fae1086000
Fixed
ff9da1f35cfc4398a77832462812e559ef342cb8
Introduced
cce9d82bf48dbc0082a84aab7bfac55a56eda65d
Fixed
a47e6774fb55adfb8ed2151bea7afacb047f5ede
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.0.0"
        },
        {
            "fixed": "1.2.17"
        },
        {
            "introduced": "1.3.0"
        },
        {
            "fixed": "1.3.8"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.4.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.0.0-alpha1
1.0.0-alpha2
1.0.0-alpha3
1.0.0-alpha4
1.0.0-alpha5
1.0.0-alpha6
1.0.0-alpha7
1.0.0-alpha8
1.0.0-beta1
1.0.0-beta2
1.0.0-beta3
1.0.0-beta4
1.0.0-beta5
1.0.0-beta6
1.0.0-beta7
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.1.0-beta1
1.2.0
1.2.0-alpha1
1.2.0-alpha2
1.2.0-beta1
1.2.0-rc1
1.2.0-rc2
1.2.1
1.2.10
1.2.11
1.2.12
1.2.13
1.2.14
1.2.15
1.2.16
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.2.9
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.3.7
1.4.0
1.4.1
1.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13235.json"