p PatchFirst

CVE-2026-13236

CVE-2026-13236 · AI Agents - Less critical - Access bypass - SA-CONTRIB-2026-056

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

CVSS 4.2 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • ai agents

    Versions
    • ≥ 0.0.0, < 1.1.4: Affected (semver)
    • ≥ 1.2.0, < 1.2.5: Affected (semver)
    • ≥ 1.3.0, < 1.3.1: Affected (semver)

    Update to 1.1.4; Update to 1.2.5; Update to 1.3.1

  • drupal/ai_agents Packagist:https://packages.drupal.org/8

    Affected ranges
    • ECOSYSTEM: < 1.1.4
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.5
    • ECOSYSTEM: ≥ 1.3.0, < 1.3.1

    Update to 1.1.4; Update to 1.2.5; Update to 1.3.1

Original sources

Check your server →