CVE-2026-13237 AI Agents - Moderately critical - Information disclosure, Access bypass - SA-CONTRIB-2026-057

What is CVE-2026-13237?

CVE-2026-13237 is a medium-severity missing authorization vulnerability in Drupal AI Agents, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2.5, from 1.3.0 to 1.3.1.

Weakness: CWE-863

Which versions are affected by CVE-2026-13237?

It affects 1 product.

Products include Artificial Intelligence Project Artificial Intelligence.

How do I fix CVE-2026-13237?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-13237 being exploited?

There is no known exploitation of CVE-2026-13237 in the wild and no public exploit code.

Other vulnerabilities in Drupal AI Agents

• CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003 High 8.8
• CVE-2025-31678 AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004 High 8.2
• CVE-2026-3573 AI (Artificial Intelligence) - Moderately critical - Information Disclosure - SA-CONTRIB-2026-028 High 7.5
• CVE-2025-31692 AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021 High 7.5
• CVE-2025-31693 AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022 Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DRUPAL-CONTRIB-2026-057, GHSA-7c7x-54hv-3m8c.