CVE-2026-107307

Name of the Vulnerable Software and Affected Versions SmartLinker AI versions 0.0.0 through 1.0.3

Description An incorrect authorization issue allows forceful browsing. The module provides a Generate internal links action for the AI CKEditor toolbar, enabling editors to search for relevant site content to link to. The search query fails to respect entity access when returning results to the browser. This issue is mitigated by the requirement that a user must have permission to use the AI CKEditor Generate internal links feature on a text format.

Recommendations Update SmartLinker AI to a version newer than 1.0.3.