{"id":"CVE-2026-0748","aliases":["CLSA-2026-1789632846","EUVD-2026-16420","GHSA-qwjq-cprg-rrcp"],"status":"published","title":"Access bypass in Drupal 7 i18n_node translation UI","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00421,"percentile":0.36717,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276","CWE-284"],"published":"2026-03-26T21:17:37Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"TuxCare:Packagist","package":"drupal/i18n","fixed_in":["7.1.35-p1+tuxcare"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Packagist","package":"drupal/i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.35"},{"fixed":"7.1.35-p1+tuxcare"}]}],"versions":["7.1.35"]}],"products":[{"vendor":"drupal","product":"internationalization (i18n) - i18n_node submodule"},{"vendor":"internationalization_project","product":"internationalization"}],"references":[{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-0748","tags":["third-party-advisory","Exploit","Third Party Advisory","advisory"]},{"url":"https://d7es.tag1.com/node/86","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7","tags":["exploit","Exploit","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-0748","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qwjq-cprg-rrcp"},{"url":"https://git.drupalcode.org/project/i18n","tags":["web"]},{"url":"https://www.drupal.org/project/i18n","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0748.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-0748","title":"Access bypass in Drupal 7 i18n_node translation UI","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","status":"published","published":"2026-03-26T21:17:37.769Z","modified":"2026-03-27T13:55:09.117Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:13.587351Z"}],"euvd":[{"id":"EUVD-2026-16420","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","status":"published","published":"2026-03-26T21:17:37Z","modified":"2026-03-27T13:55:09Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:27.67679Z"}],"ghsa":[{"id":"GHSA-qwjq-cprg-rrcp","title":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with...","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","status":"published","published":"2026-03-27T00:31:20Z","modified":"2026-04-01T18:37:42Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-276","CWE-284"],"updated_at":"2026-11-02T15:07:04.885246Z"}],"nvd":[{"id":"CVE-2026-0748","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","status":"published","published":"2026-03-26T22:16:27.1Z","modified":"2026-06-17T10:11:18.803Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284","CWE-276"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-0748","title":"Access bypass in Drupal 7 i18n_node translation UI","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","status":"published","published":"2026-03-26T21:17:37.769Z","modified":"2026-10-28T02:31:10.770468352Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:44:53.490346Z"},{"id":"CLSA-2026-1789632846","title":"TuxCare security update for drupal/i18n (1 CVE)","description":"TuxCare rebuilt drupal/i18n to address 1 CVE. Fixed in 7.1.35-p1+tuxcare.","status":"published","published":"2026-09-17T08:14:06Z","modified":"2026-10-15T09:48:00.57957401Z","updated_at":"2026-11-02T15:43:48.28229Z"}]}}