AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

Project: AI (Artificial Intelligence)Date: 2025-January-22Security risk: Moderately critical 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypass, Information DisclosureAffected versions: <1.0.3Description: The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes.
The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged.

This vulnerability is mitigated by the fact that it only affects sites using the AI Logging sub-module with 'Log requests' enabled in the AI Logging configuration page.Solution: Install the latest version:

• If you use AI 1.x, upgrade to AI 1.0.3.

An update hook will update the view to use the view ai log permission. If you use version controlled configuration, remember to capture this.
(or) Disable the AI Logging module.
(or) Manually update the ai_logs view's access check to use the view ai log permission.Reported By: 

• Mingsong

Fixed By: 

• Scott Euser
• Marcus Johansson
• Andrew Belcher

Coordinated By: 

• Greg Knaddison of the Drupal Security Team
• Juraj Nemec of the Drupal Security Team
• Dave Long of the Drupal Security Team