CVE-2026-0748 - Access bypass in Drupal 7 i18n_node translation UI

Back Back to CVE browser

MEDIUM

Access bypass in Drupal 7 i18n_node translation UI

Published Mar 26, 2026

5.3

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs.

Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

Affected products

Vendor Drupal Product Internationalization (i18n) - i18n node submodule Default
unaffected
- Version
  7.x-1.0
  Status
  affected
  Constraints
  <=7.x-1.35

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Drupal

Internationalization (i18n) - i18n node submodule

unaffected

Version	Status	Constraints
7.x-1.0	affected	<=7.x-1.35

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-276

Incorrect Default Permissions

CWE-284

References (4)

https://d7es.tag1.com/node/86
third-party-advisoryThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16420
Advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-0748
third-party-advisoryExploitThird Party Advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7
exploitThird Party Advisory

Link	Providers	Tags
https://d7es.tag1.com/node/86		third-party-advisoryThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16420		Advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-0748		third-party-advisoryExploitThird Party Advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7		exploitThird Party Advisory