Vulnerability · Published Mar 26, 2026 · Assigned by drupal

CVE-2026-0748Access bypass in Drupal 7 i18n_node translation UI

Medium 5.3

In plain English

A medium-severity improper access control in Internationalization (i18n) - i18n_node submodule from Drupal. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 4.0)5.3Medium

Exploit odds (30 days)0.4%top 63.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

Affected products (as reported)

Vendor	Product	Versions
Drupal	Internationalization (i18n) - i18n_node submodule	7.x-1.0 – through 7.x-1.35

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://www.herodevs.com/vulnerability-directory/cve-2026-0748 third-party-advisory
https://d7es.tag1.com/node/86 third-party-advisory
https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7 exploit