CVE-2026-13237

Received Received - Intake

Incorrect Authorization in Drupal AI Agents Allows Forceful Browsing

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: Drupal.org

Description

Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-13237

EUVD

EUVD-2026-43061

Affected Vendors & Products

Vendor	Product	Version / Range
drupal	ai_agents	From 0.0.0 (inc) to 1.1.4 (inc)
drupal	ai_agents	From 1.2.0 (inc) to 1.2.5 (inc)
drupal	ai_agents	From 1.3.0 (inc) to 1.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in Drupal AI Agents that allows Forceful Browsing. Forceful Browsing means an attacker can access resources or pages they are not authorized to view by manipulating URLs or requests.

It affects multiple versions of the AI Agents module, specifically versions from 0.0.0 to 1.1.4, 1.2.0 to 1.2.5, and 1.3.0 to 1.3.1.

Impact Analysis

This vulnerability can allow unauthorized users to access restricted areas or data within the Drupal AI Agents module by bypassing normal authorization controls.

Such unauthorized access could lead to exposure of sensitive information or unauthorized actions within the affected system.

Hi! I’m here to help you understand CVE-2026-13237. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70