[IT-SecNots] [Security-news] AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-120

Project: AI (Artificial Intelligence) [1]
Date: 2026-September-02
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access Bypass

Affected versions: <1.3.13 || >=1.4.0 <1.4.8
CVE IDs: CVE-2026-84912
Description: 
This submodule AI Translate enables you to automatically translate entities.

The module doesn't sufficiently check access on the entity to be translated,
related fields or referenced entities when performing an AI translation on an
entity or when those fields / entities have a different access level than the
parent entity. This permission bypass is only applicable to the translate
operation - no unwarranted read or update access is granted to the affected
entities

Solution: 
Install the latest version:

 * If you use the AI module 1.4.7 or below upgrade to AI module 1.4.8 [3]
 * If you use the AI module 1.3.12 or below upgrade to AI module 1.3.13 [4]

Reported By: 
 * Marcus Johansson (marcus_johansson) [5]

Fixed By: 
 * Artem Dmitriiev (a.dmitriiev) [6]
 * Marcus Johansson (marcus_johansson) [7]
 * Sven Decabooter (svendecabooter) [8]
 * Valery Lourie (valthebald) [9]

Coordinated By: 
 * Greg Knaddison (greggles) [10] of the Drupal Security Team
 * Juraj Nemec (poker10) [11] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [12]

[1] https://www.drupal.org/project/ai
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ai/releases/1.4.8
[4] https://www.drupal.org/project/ai/releases/1.3.13
[5] https://www.drupal.org/u/marcus_johansson
[6] https://www.drupal.org/u/admitriiev
[7] https://www.drupal.org/u/marcus_johansson
[8] https://www.drupal.org/u/svendecabooter
[9] https://www.drupal.org/u/valthebald
[10] https://www.drupal.org/u/greggles
[11] https://www.drupal.org/u/poker10
[12]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3618959

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at