Andrew Belcher

An incorrect authorization issue allows forceful browsing. Under certain conditions, the agent inherits deterministic parameters when invoking the same tool within a single request, which may result in information disclosure.

A functionality bypass exists in Drupal CAPTCHA due to insufficient invalidation of security tokens. An attacker may bypass the CAPTCHA on subsequent submissions if they first successfully solve at least one CAPTCHA manually to obtain valid tokens.

The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI (Artificial Intelligence).

The issue is a Cross-Site Request Forgery (CSRF) vulnerability, which allows an attacker to perform actions on a user's behalf without their consent. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the user is authenticated to.