Access Control Bypass in Drupal 7 Internationalization Module
CVE-2026-0748

5.3MEDIUM

Key Information:

Vendor

Drupal
Status
Internationalization (i18n) - I18n Node Submodule
Vendor
CVE Published:
26 March 2026

What is CVE-2026-0748?

The i18n_node submodule in the Drupal 7 Internationalization module presents a security flaw that enables users with the 'Translate content' and 'Administer content translations' permissions to access unpublished nodes. This vulnerability allows unauthorized users to view unpublished node titles and IDs through the translation UI and its autocomplete widget, circumventing the intended access controls. It is crucial for organizations using affected versions to address this weakness to ensure sensitive content remains protected.

Affected Version(s)

Internationalization (i18n) - i18n_node submodule 7.x-1.0 <= 7.x-1.35

References

https://www.herodevs.com/vulnerability-directory/cve-2026...
third-party-advisory
https://d7es.tag1.com/node/86
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tatár Balázs János (tatarbj)
.