CVE-2026-84913 Drupal CVE debrief

Who should care

Defenders responsible for Drupal installations with the AI Translate module should assess exposure and prioritize patching or mitigation. This includes verifying the AI Translate module version, applying patches or mitigations as available, and monitoring for potential Forceful Browsing attempts. Additionally, defenders should update their inventory of affected systems and review compensating controls for exposed

Why it matters

The CVE-2026-84913 vulnerability in the Drupal AI Translate module allows for Forceful Browsing, impacting Drupal installations with the module. Defenders should verify and patch vulnerable versions, monitor for unusual activity, and update their inventory of affected systems.

• Verify and patch vulnerable AI Translate module versions to prevent potential Forceful Browsing attempts
• Monitor for unusual browsing activity that may indicate exploitation attempts
• Assess and update inventory of Drupal installations with AI Translate module

Technical summary

The Drupal AI Translate module is vulnerable to a Missing Authorization issue, allowing for Forceful Browsing. The vulnerability affects versions from 0.0.0 to 1.3.2 and from 1.4.0 to 1.4.1. This issue has a moderate severity and requires immediate attention to prevent potential exploitation. The vulnerability allows attackers to bypass authorization, potentially leading to unauthorized access. Defenders should prioritize verifying the AI Translate module version and applying patches or mitigations as available.

Defensive priority

Defenders should prioritize verifying the AI Translate module version and applying patches or mitigations as available.

Recommended defensive actions

• Verify AI Translate module version and assess exposure
• Apply patches or mitigations as available
• Monitor for potential Forceful Browsing attempts

Evidence notes

The CVE record and source item provide details on the vulnerability and affected versions. The Drupal AI Translate module is vulnerable to a Missing Authorization issue, allowing for Forceful Browsing. The issue affects AI Translate versions from 0.0.0 to 1.3.2 and from 1.4.0 to 1.4.1. Defenders should verify and patch vulnerable versions, monitor for unusual activity, and update their inventory of affected systems. The evidence is based on the CVE record and source item, which provide

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.