p PatchFirst

CVE-2026-13237

CVE-2026-13237 · AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

CVSS 4.8 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • ai agents

    Versions
    • ≥ 0.0.0, < 1.1.4: Affected (semver)
    • ≥ 1.2.0, < 1.2.5: Affected (semver)
    • ≥ 1.3.0, < 1.3.1: Affected (semver)

    Update to 1.1.4; Update to 1.2.5; Update to 1.3.1

  • drupal/ai_agents Packagist:https://packages.drupal.org/8

    Affected ranges
    • ECOSYSTEM: < 1.1.4
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.5
    • ECOSYSTEM: ≥ 1.3.0, < 1.3.1

    Update to 1.1.4; Update to 1.2.5; Update to 1.3.1

Original sources

Check your server →