CVE-2026-0748mediumCWE-284

CVE-2026-0748: medium-severity vulnerability in Drupal Internationalization (i18n) - i18n_node…

Access bypass in Drupal 7 i18n_node translation UI

Published 26 Mar 2026 · Updated 27 Mar 2026

Follow this CVE + Monitor Internationalization - i18n node submodule

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Affected products

Drupal · Internationalization (i18n) - i18n_node submodule

References

https://d7es.tag1.com/node/86 https://www.herodevs.com/vulnerability-directory/cve-2026-0748 https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7