CVE-2026-0748mediumCWE-284

CVE-2026-0748: falha de média gravidade em Drupal Internationalization (i18n) - i18n_node…

Access bypass in Drupal 7 i18n_node translation UI

Publicada em 26 mar 2026 · Atualizada em 27 mar 2026

Seguir esta CVE + Monitorar Internationalization - i18n node submodule

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Produtos afetados

Drupal · Internationalization (i18n) - i18n_node submodule

Referências

https://d7es.tag1.com/node/86 https://www.herodevs.com/vulnerability-directory/cve-2026-0748 https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7