Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.
PUBLISHED5.2CWE-863
AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028
Problem type
Affected products
Drupal
AI (Artificial Intelligence)
< 1.1.11 - AFFECTED
< 1.2.12 - AFFECTED
References
GitHub Security Advisories
GHSA-99mr-fjvp-4w9w
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource...
https://github.com/advisories/GHSA-99mr-fjvp-4w9wIncorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-3573Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-3573",
"assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"assignerShortName": "drupal",
"dateUpdated": "2026-03-26T20:10:13.350Z",
"dateReserved": "2026-03-04T21:17:43.868Z",
"datePublished": "2026-03-26T20:10:13.350Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
"shortName": "drupal",
"dateUpdated": "2026-03-26T20:10:13.350Z"
},
"datePublic": "2026-03-11T16:33:00.000Z",
"title": "AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028",
"descriptions": [
{
"lang": "en",
"value": "Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.",
"supportingMedia": [
{
"type": "text/html",
"base64": false,
"value": "Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection.<p>This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.1.11, from 1.2.0 before 1.2.12.</p>"
}
]
}
],
"affected": [
{
"vendor": "Drupal",
"product": "AI (Artificial Intelligence)",
"collectionURL": "https://www.drupal.org/project/ai",
"repo": "https://git.drupalcode.org/project/ai",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"status": "affected",
"versionType": "semver",
"lessThan": "1.1.11"
},
{
"version": "1.2.0",
"status": "affected",
"versionType": "semver",
"lessThan": "1.2.12"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-863 Incorrect Authorization",
"cweId": "CWE-863",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://www.drupal.org/sa-contrib-2026-028"
}
],
"impacts": [
{
"capecId": "CAPEC-240",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-240 Resource Injection"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Marcus Johansson (marcus_johansson)",
"type": "finder"
},
{
"lang": "en",
"value": "Artem Dmitriiev (a.dmitriiev)",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Abhisek Mazumdar (abhisekmazumdar)",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Dave Long (longwave)",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Marcus Johansson (marcus_johansson)",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Valery Lourie (valthebald)",
"type": "remediation developer"
},
{
"lang": "en",
"value": "Greg Knaddison (greggles)",
"type": "coordinator"
},
{
"lang": "en",
"value": "Drew Webber (mcdruid)",
"type": "coordinator"
},
{
"lang": "en",
"value": "Jess (xjm)",
"type": "coordinator"
}
]
}
}
}