CVE-2026-84912

Name of the Vulnerable Software and Affected Versions Drupal AI versions 0.0.0 through 1.3.13 Drupal AI versions 1.4.0 through 1.4.8

Description An authorization flaw in the AI Translate submodule allows forceful browsing. The module fails to sufficiently verify access permissions for entities, related fields, or referenced entities during the AI translation process, particularly when these components have different access levels than the parent entity. This results in a permission bypass specifically for the translation operation, although it does not grant unauthorized read or update access to the affected entities.

Recommendations Update Drupal AI versions 0.0.0 through 1.3.13 to a version newer than 1.3.13. Update Drupal AI versions 1.4.0 through 1.4.8 to a version newer than 1.4.8.