VULNERABILITY INTELLIGENCE

CVE-2026-0748

CVSS score4.3 MEDIUM
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-03-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

Weakness classification

  • mlhess@drupal.org: CWE-284
  • nvd@nist.gov: CWE-276

Primary references