critical · CVSS v3 9.8

CVE-2026-87936

The CVE-2026-87936 vulnerability is a critical SQL injection flaw in the amazee.ai Private AI Provider, a Drupal-based service. It allows at

Overview

The CVE-2026-87936 vulnerability is a critical SQL injection flaw in the amazee.ai Private AI Provider, a Drupal-based service. It allows attackers to inject malicious SQL commands, potentially exposing or corrupting sensitive data. The flaw affects all versions up to 1.4.3.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.3.

Impact

An attacker can read, modify, or delete database contents, compromising confidentiality, integrity, and availability of the application. This threatens any organization that hosts or relies on the amazee.ai Private AI Provider for AI services.

Remediation

Apply the latest patch that removes the vulnerable code (upgrade to version 1.4.4 or later). If an upgrade is not immediately possible, enforce strict input validation, use parameterized queries, and restrict database user privileges. Deploy a web application firewall to block suspicious SQL patterns and monitor database logs for anomalous activity.

Risk context

Severity is critical with a CVSS v3 score of 9.8, indicating a high urgency for remediation. The lack of an EPSS score does not reduce the immediate risk.

Affected products

  • amaze.ai Private AI Provider

Scores

Severity
critical
CVSS v2
7.5
CVSS v3
9.8
CVSS v4
—
EPSS
—

sql-injection drupal critical database web-application

← All CVEs

Related CVEs

critical

CVE-2026-84920

Drupal Unpublished Node Permissions allows attackers to forcefully browse unpublished content due to incorrect authorization checks. The flaw exists in versions 0.0.0 through 1.8.0 and can expose sensitive draft pages to unauthenticated users. It is a critical vulnerability with a CVSS score of 9.1.

View analysis

critical

CVE-2026-84921

Drupal Webform Submissions Delete plugin has a missing authorization flaw that lets attackers delete any submission. The vulnerability is present in all releases up to 1.2.0. It can be exploited by unauthenticated users to remove data and potentially disrupt site operations.

View analysis

critical

CVE-2026-84916

Drupal Islandora is vulnerable to missing authorization, enabling forceful browsing of restricted content. Attackers can access sensitive data without authentication. This flaw affects all Islandora releases up to 2.19.0.

View analysis

critical

CVE-2026-84917

Drupal Jsonapi Role Access module has an incorrect authorization flaw that permits forceful browsing of restricted JSON endpoints. Attackers can access sensitive data without proper role checks. The vulnerability affects all versions up to 2.0.2.

View analysis