Vulnerability Directory | CVE-2026-0748 | Drupal 7

Overview

Drupal is an open-source content management system known for its flexibility, robust features, and strong community support. Organizations of all sizes use it to build and manage dynamic websites and web applications.

In the i18n_node submodule for Drupal 7, a user with both “Translate content” and “Administer content translations” can see and attach unpublished nodes through the translation tab and its autocomplete. This bypasses intended access controls and exposes unpublished titles and IDs, allowing a translator to link content they shouldn’t be able to view.

Broken Access Control occurs when an application fails to properly enforce restrictions on what authenticated users are allowed to do, enabling attackers to access unauthorized functionality, data, or resources. It often stems from inadequate validation of user permissions, allowing someone to bypass intended security boundaries and perform actions beyond their assigned role.

Any of the following ramifications are possible:

Allowing arbitrary code execution
Complete system compromise
Data theft or exposure
Data manipulation or destruction
Privilege escalation, and
Denial of service.

This issue affects the i18n version 7.1.35 and lower.

‍

Details

Module Info

Product: Drupal
Affected code: i18n module
Affected versions: >=7.1.0 <=7.1.35
Project page: http://drupal.org/project/i18n
Fixed in: i18n NES 7.1.36

‍

Vulnerability Info

This medium-severity vulnerability is a Broken Access Control issue found in the i18n_node sub-module of the Drupal 7 Internationalization (i18n) module (versions ≤ 7.1.35).

The flaw allows users with certain translation permissions to bypass intended node access restrictions to view and attach unpublished content. The resulting Information Exposure is addressed in the NES build, which updates the module's translation administration workflow to ensure that unpublished nodes are no longer revealed or attachable to unauthorized users.

‍

Steps To Reproduce

Create a vanilla Drupal 7 installation and install a version of the i18n module that is vulnerable to the exploit, such as 7.1.35.
Install and enable i18n and i18n_node.
Visit Configuration → Regional and language → Languages (admin/config/regional/language/add) to add a second language.
Make “Article” translatable at Structure → Content types → Article → Edit (admin/structure/types/manage/article) then Publishing options → Enabled, with translation.
Create an Article at node/add/article and set it to English. Create another and set it to the second language. Set both to Unpublished. Note their node IDs.
Create the role “Translator” (at admin/people/permissions/roles).
Add the following permissions (at admin/people/permissions) with exactly these permissions: “Translate content,” “Administer content translations” and “View own unpublished content.” Ensure “bypass node access” is not enabled. Save the permissions.
Create a user (at admin/people/create) with that role and log in as that user.
Visit node/[unpublished-node-id]/translate: the translation tab shows the unpublished node’s title/ID and links, even though the user shouldn’t see it.
On that page, use the translation autocomplete (below the translation links) to search for another unpublished node’s title: the JSON response returns unpublished titles/IDs and lets you attach them as translations.
Visit the second Article and confirm the same.

Addressing the Issue

Users of the affected components should apply one of the following:

Implement custom node access checks via hook_menu_alter().
Remove the 'administer content translations' permission until the patched code is installed.
Disable the autocomplete function via a hook.
Implement a custom callback that intercepts the autocomplete request.
Sign up for post-EOL security support; HeroDevs customers get immediate access to a patched version of this module.

‍