{"data":{"id":"3f5a93ef-11ea-44c5-99fe-4ed4ae7620ff","title":"CVE-2026-13237: Incorrect Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents…","summary":"CVE-2026-13237 is an Incorrect Authorization flaw (CWE-863) in Drupal AI Agents that allows Forceful Browsing. The issue affects AI Agents versions 0.0.0 to 1.1.4, 1.2.0 to 1.2.5, and 1.3.0 to 1.3.1. NVD has not yet provided an assessment, and the vulnerability was published by Drupal.org on 07/10/2026.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13237","publishedAt":"2026-07-10T22:16:39.797Z","cveId":"CVE-2026-13237","cweIds":["CWE-863"],"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Drupal AI Agents"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Drupal AI Agents incorrect authorization allows forceful browsing","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00217,"epssCheckedAt":"2026-10-14T06:09:06.335Z","kevDateAdded":null,"advisoryAliases":["GHSA-7c7x-54hv-3m8c"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-10T03:46:51.077Z","patchAvailable":null,"disclosureDate":"2026-07-10T22:16:39.797Z","capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}