CVE-2026-0748

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

In the i18n_node submodule for Drupal 7, a user with both “Translate content” and “Administer content translations” can see and attach unpublished nodes through the translation tab and its autocomplete. This bypasses intended access controls and exposes unpublished titles and IDs, allowing a translator to link content they shouldn’t be able to view.

Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.

Any of the following ramifications are possible:

• Allowing arbitrary code execution
• Complete system compromise
• Data theft or exposure
• Data manipulation or destruction
• Privilege escalation, and
• Denial of service.

This issue affects the i18n version 7.1.35 and lower.

‍

Details

Module Info

• Product: Drupal
• Affected code: i18n module
• Affected versions: >=7.1.0 <=7.1.35
• Project page: http://drupal.org/project/i18n
• Fixed in:  i18n NES 7.1.36

‍

Vulnerability Info

This medium-severity vulnerability is a Broken Access Control issue found in the i18n_node sub-module of the Drupal 7 Internationalization (i18n) module (versions ≤ 7.1.35).

The flaw allows users with certain translation permissions to bypass intended node access restrictions to view and attach unpublished content. The resulting Information Exposure is addressed in the NES build, which updates the module's translation administration workflow to ensure that unpublished nodes are no longer revealed or attachable to unauthorized users.

‍

Addressing the Issue

Users of the affected components should apply one of the following:

• Implement custom node access checks via hook_menu_alter().
• Remove the 'administer content translations' permission until the patched code is installed.
• Disable the autocomplete function via a hook.
• Implement a custom callback that intercepts the autocomplete request.
• Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍

Credits

• Tatár Balázs János (tatarbj)

‍