View online: https://www.drupal.org/sa-contrib-2026-120 Project: AI (Artificial Intelligence) [1] Date: 2026-September-02 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Affected versions: <1.3.13 || >=1.4.0 <1.4.8 CVE IDs: CVE-2026-84912 Description: This submodule AI Translate enables you to automatically translate entities. The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the parent entity. This permission bypass is only applicable to the translate operation - no unwarranted read or update access is granted to the affected entities Solution: Install the latest version: * If you use the AI module 1.4.7 or below upgrade to AI module 1.4.8 [3] * If you use the AI module 1.3.12 or below upgrade to AI module 1.3.13 [4] Reported By: * Marcus Johansson (marcus_johansson) [5] Fixed By: * Artem Dmitriiev (a.dmitriiev) [6] * Marcus Johansson (marcus_johansson) [7] * Sven Decabooter (svendecabooter) [8] * Valery Lourie (valthebald) [9] Coordinated By: * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [12] [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.4.8 [4] https://www.drupal.org/project/ai/releases/1.3.13 [5] https://www.drupal.org/u/marcus_johansson [6] https://www.drupal.org/u/admitriiev [7] https://www.drupal.org/u/marcus_johansson [8] https://www.drupal.org/u/svendecabooter [9] https://www.drupal.org/u/valthebald [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10 [12] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....