## Summary On Drupal 11.4.8 with ai_context 1.0.0-rc1, ai 1.5.0 and ai_agents 1.3.5, any user who holds the permission "Use Published AI Context in AI Features" (`access published ai context`, which is not marked `restrict access`) and can reach an AI agent or chatbot that exposes the module's Context Tools, or any AI request the module routes to a consumer, can supply an arbitrary entity type and ID and observe whether a context item scoped to that entity type and bundle is selected. The module loads the hinted entity without checking view access, so the answer reveals whether an unpublished node, an unpublished taxonomy term or any other content entity exists and which bundle (content type, vocabulary) it belongs to. No field data of the hidden entity is disclosed. The module's own Taxonomy Terms scope performs the access check that the Entity Types scope omits, so the module treats this kind of leak as something it intends to prevent. The disclosure is limited to existence and bundle, which makes this a borderline report, and the decision on whether it warrants an advisory is left to the security team. ## Reproduction steps 1. Install ai, ai_agents and ai_context on Drupal 11.4.8 and configure any chat provider (the shipped `ai_test` module with its echoai provider is enough). 2. As an administrator, create a vocabulary "Topics" (machine name `topics`) and inside it an unpublished term "Secret topic"; note its term ID, called N below. 3. At /admin/config/ai/context/items/add create a context item "Topics guidance" with any content, set the Entity Types scope to "Taxonomy term: Topics" (stored value `taxonomy_term:topics`) and publish it. 4. At /admin/people/roles/add create a role "Reader" with only the permission "Use Published AI Context in AI Features", and create a user "reader" with that role. 5. Log in as reader and open /taxonomy/term/N; the page is not accessible (404). 6. Run the list tool as reader, once for term N and once for a missing ID, with `drush php:script` on the following script: ```php <?php $reader = user_load_by_name('reader'); \Drupal::service('account_switcher')->switchTo($reader); foreach ([N, 999999] as $id) { $tool = \Drupal::service('plugin.manager.ai.function_calls')->createInstance('ai_context:list_ai_context_items'); $tool->setContextValue('entity_type', 'taxonomy_term'); $tool->setContextValue('entity_id', $id); $tool->execute(); print "entity_id=$id\n" . $tool->getReadableOutput() . "\n\n"; } \Drupal::service('account_switcher')->switchBack(); ``` 7. Compare the two outputs: the run for term N lists "Topics guidance", the run for 999999 does not, although reader cannot view term N. 8. Optional: assign the "List AI Context Items" tool to an agent used by a chatbot the reader can use and ask "list the context items for taxonomy term N"; the chat answer shows the same difference. ## Impact A user with the unrestricted permission and access to any agent, chatbot or routed AI request can enumerate IDs of every content entity type enabled in the Entity Types scope settings and learn, for each ID, whether the entity exists and which content type or vocabulary it belongs to, including unpublished nodes and terms the user is not allowed to view. An extremely minor finding. ## Proposed resolution `AiContextRequestInfoResolver::getEntityTypeFromEntity()` (`src/Service/AiContextRequestInfoResolver.php:378-390`) loads the request entity with `loadEntityById()` (`:331-341`) and does not check access. The Entity Types scope reads this value (`src/Plugin/AiContextScope/AiContextScopeEntityType.php:411`). `loadContentEntity()` in the same class (`:242-277`) already checks `access('view')` (`:272`), and the Taxonomy Terms scope uses it (`src/Plugin/AiContextScope/AiContextScopeTaxonomy.php:417`). * Use `loadContentEntity()` in `getEntityTypeFromEntity()`. When the entity is missing or the user cannot view it, return NULL, so that an entity the user cannot view gives the same result as an ID that does not exist. * A caller-supplied bundle hint (`setEntityBundle()`, or `entity_type` plus `bundle` in `entity_context`) still applies when no entity is loaded. The caller supplies the bundle, so the hint reveals nothing new. * Check the other scopes that read the request entity, and make sure that all of them use the access-checked loader. ## Remaining tasks 1. [x] Fix `getEntityTypeFromEntity()`. 2. [x] Kernel test: a reader who cannot view an unpublished term gets the same List tool output and selection result as for an ID that does not exist. The reader has "Use Published AI Context in AI Features" and "View published content", so the unpublished status is the reason for the denial. The reader still gets the matching item for a published term, and a user who can view the unpublished term gets it for that term. 3. [x] Kernel test: the bundle hint for an unsaved entity still matches Entity Types. 4. [x] Kernel test: the result is not reused across account switches in one request, and across requests (a route switch). The loaders cache per entity, not per account or request. 5. [x] Selection results carry the cache metadata of the resolver's own view access check, on the revision or translation that the route upcasts. Kernel tests: two users with the same permissions and an unpublished node that one of them owns, a published node that users share, and a draft revision on the revision route. 6. [x] Kernel test: the cache metadata of a denied access result is added (`testDeniedAccessCacheabilityIsAdded`). 7. [x] Release note. 8. [x] Open the MR (!351). Tests and `./lint.sh` pass on the MR branch. 9. [x] Run the functional tests and do the manual check in the MR testing instructions. kieran.cott did the manual check on 2026-10-19. CI pipeline 1015452 ran the full PHPUnit suite on Drupal 11 and Drupal 10. 10. [x] Add the resolver's view access cacheability to the selection result even when Entity Types and Taxonomy Terms are off, so a custom scope cannot reuse another account's result. 11. [x] `applyRequestInfo()` clears a route entity saved for an earlier request before the route check. On the same request, the route entity still wins. Kernel test: `testLaterRequestAppliesSuppliedEntity`. ## Disclosure AI was used to find this issue, verify it against a running site, video record it, screenshot it and write the report. The issue was then manually verified by the person filing it before submission.