Scott Euser

Incorrectly configured access control security levels in the AI Search submodule allow the web browser cache to contain sensitive information. While the AI Search backend verifies access for each search result, this check is ignored when Search API caches view results. Consequently, users may see cached search results, such as titles and fields of unpublished or restricted content, if a user with appropriate permissions performed the same search within the cache lifetime. This occurs when the AI Search submodule is enabled and a Search API view uses time-based, tag-based, or combined time and tag-based result caching.

An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify role delegation during the user approval process and provides an Activate link for blocked administrators. Additionally, it does not prevent the deactivation or deletion of user 1. Exploitation requires the attacker to possess a role with one of the module's additional action permissions.

The issue is related to a Missing Authorization vulnerability, which allows Forceful Browsing in Drupal AI (Artificial Intelligence).