CVE-2026-107307

SmartLinker AI search ignores entity access

Drupal maintainers · SmartLinker AI / AI CKEditor internal-link action

First documented disclosure · Review checkpoint

Summary

Internal-link suggestions can disclose content the editor cannot access.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: Drupal labels exploitation theoretical; reviewed sources establish neither malicious exploitation nor a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The content search does not apply entity access checks before returning browser results.

Conditions required

Permission to use AI CKEditor’s Generate internal links feature on a text format.

Potential impact

Disclosure of access-restricted content through search results.

Affected versions and configurations

SmartLinker AI before 1.0.3.

Fix and mitigation status

SmartLinker AI 1.0.3.

Practical next steps

Upgrade and limit access to the internal-link generation feature until patched.

Operating lesson

AI-assisted search must enforce the same content permissions as direct access.

Evidence and limits

The vendor advisory was public 2026-10-07; October 30 is later CNA publication. Drupal rates this Moderately critical 11/25 under its own risk system, not CVSS; no numeric CVSS is inferred.

Sources