PatchClock

PHP security digest · 7 Oct 2026

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for re...

Unrated CVE-2026-107307

Package
drupal/smartlinker_ai
Fixed in
1.0.3
Published
Wed 7 Oct 2026, 17:35 LisbonUpdated Mon 26 Oct 2026, 04:26 Lisbon

In plain words

The module's internal-link search can return results to the browser without checking whether the user is allowed to access the content. A user must have permission to use the AI CKEditor "Generate internal links" feature on a text format to encounter this flaw.

Am I affected?

Look for drupal/smartlinker_ai and its installed version in composer.lock. The advisory lists 1.0.3 as fixed but gives no affected version range. Check which users have permission to use the AI CKEditor "Generate internal links" feature on a text format.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.3):

composer show drupal/smartlinker_ai | grep versions
composer update drupal/smartlinker_ai

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

If you cannot update yet

The advisory says the flaw is mitigated by requiring users to have permission to use the AI CKEditor "Generate internal links" feature on a text format.

The advisory's description

This module adds a "Generate internal links" action to the AI CKEditor toolbar, letting editors select text and have the module search the site's content for relevant pages to link to.

The module's search query did not respect entity access when returning results to the browser.

This vulnerability is mitigated by the fact that an user must have permission to use the AI CKEditor "Generate internal links" feature on a text format.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.