CVE-2026-114554 in AI File to Text Plugin
Summary
by MITRE • 10/30/2026
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The Drupal module known as AI File to Text, specifically within the version range of 0.0.0 through 1.0.1, contains a critical access control flaw that permits unauthorized users to bypass intended security restrictions. This vulnerability is classified under CWE-284, which denotes Improper Access Control, and manifests operationally as Forceful Browsing or Insecure Direct Object Reference (IDOR). The core technical issue stems from the module's failure to adequately verify whether the authenticated user initiating a request has the necessary permissions to access specific file resources or execute text extraction operations. Instead of enforcing strict authorization checks against the user's role and assigned privileges, the application logic relies on predictable patterns or lacks server-side validation entirely when processing requests related to uploaded files intended for AI-driven text analysis.
From an operational perspective, this flaw allows attackers who have valid credentials but insufficient administrative rights—or potentially unauthenticated users if session handling is also compromised—to interact with sensitive file data that should be restricted. By manipulating request parameters such as file identifiers or paths, a malicious actor can force the system to retrieve and process documents belonging to other users or containing confidential organizational information. This capability effectively circumvents the intended isolation between different user accounts within the Drupal environment. The attacker does not need to exploit complex injection techniques; rather, they simply browse directly to endpoints that handle file uploads or processing tasks, exploiting the lack of proper authorization middleware in these specific API routes or page handlers provided by the module.
The impact of this vulnerability extends beyond simple data leakage. Since the module is designed to process files using artificial intelligence models for text extraction, an attacker could potentially trigger resource-intensive operations on restricted documents, leading to denial-of-service conditions if large files are repeatedly processed. Furthermore, the exposure of internal file structures and metadata can aid in further reconnaissance activities within the Drupal installation. Attackers may use this information to map out user hierarchies, identify high-value targets for privilege escalation attacks, or gather sensitive content such as personal identifiable information (PII), financial records, or proprietary business documents that were never intended for public or unauthorized access.
To mitigate this risk, site administrators must immediately upgrade the AI File to Text module to a version later than 1.0.1 where these authorization checks have been corrected by the developers. Until an update is available, it is advisable to disable the module entirely if its functionality is not strictly required for daily operations. Additionally, implementing strict web application firewall rules can help block suspicious patterns of direct object reference attempts, although this serves only as a compensating control rather than a fix. Regular security audits and penetration testing should be conducted on Drupal installations using third-party modules to ensure that access controls are consistently enforced across all endpoints, particularly those involving file handling and external API integrations.