CVE-2026-13236

MediumCVSS 4.2

Published: 10/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

A missing authorization vulnerability in Drupal AI Agents allows forceful browsing. This affects versions from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, and from 1.3.0 to 1.3.1.

Risk Assessment

An attacker can gain unauthorized access to protected resources or functions, potentially leading to data leakage or system integrity compromise.

Recommendation

Immediately update the AI Agents module to the latest available version that includes a fix for the missing authorization.

Other vulnerabilities in Drupal AI Agents

CVE-2026-13237Medium
The AI Agents plugin for Drupal contains an incorrect authorization vulnerability that allows Forceful Browsing attacks. The issue affects versions from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, and from 1.3.0 to 1.3.1.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS