CVE-2026-13237

MediumCVSS 4.8

Published: 10/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The AI Agents plugin for Drupal contains an incorrect authorization vulnerability that allows Forceful Browsing attacks. The issue affects versions from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, and from 1.3.0 to 1.3.1.

Risk Assessment

An attacker can gain unauthorized access to AI agent functions or data, leading to confidentiality and integrity breaches.

Recommendation

Immediately update the AI Agents module to the latest available version that fixes this vulnerability.

Other vulnerabilities in Drupal AI Agents

CVE-2026-13236Medium
A missing authorization vulnerability in Drupal AI Agents allows forceful browsing. This affects versions from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, and from 1.3.0 to 1.3.1.

Original NVD description (English source)

Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS