CVE case study
CVE-2026-75798: Unauthenticated AI Query Execution in AI Engine
AI Engine 3.4.0 through 3.7.1 gated an administration-only assistant with a token handed to anonymous visitors, letting unauthenticated callers run AI queries against the site owner's provider account. Version 3.7.2 adds the authorization check.
- Weakness
- CWE-862
- Affected
- AI Engine 3.4.0 through 3.7.1
- Remediation state
- Upgrade to AI Engine 3.7.2 or later
- Advisory published
- 24 Aug 2026
Why it matters
AI Engine exposes an editor assistant that should be limited to administrators. In versions 3.4.0 through 3.7.1, it relied on a token handed to anonymous visitors instead of a server-side authorization check.
An unauthenticated caller could therefore run AI queries of their choosing against the site owner's configured provider account, consuming the owner's credits. The public record scores it Medium at 5.3; version 3.7.2 adds the authorization check.