{"data":{"id":"211da7a8-4617-4d3b-9515-a6f0e5081616","title":"CVE-2026-13236: Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents…","summary":"CVE-2026-13236 is a Missing Authorization flaw (CWE-862) in Drupal AI Agents that allows Forceful Browsing. It affects versions 0.0.0 through 1.1.4, 1.2.0 through 1.2.5, and 1.3.0 through 1.3.1. NVD has not yet provided an assessment, and the flaw was published 07/10/2026 by Drupal.org.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13236","publishedAt":"2026-07-10T22:16:39.700Z","cveId":"CVE-2026-13236","cweIds":["CWE-862"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Drupal AI Agents"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Drupal AI Agents missing authorization allows forceful browsing","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00188,"epssCheckedAt":"2026-10-15T00:11:27.695Z","kevDateAdded":null,"advisoryAliases":["GHSA-vqr6-3h85-q7hp"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:51.562Z","patchAvailable":null,"disclosureDate":"2026-07-10T22:16:39.700Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}