PT-2026-28309 · Unknown+1 · I18N Node Submodule+2

CVE-2026-0748 · Publicado 2026-03-26 · Atualizado 2026-03-26

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Drupal versions 7.x-1.0 through 7.x-1.35

Description The Internationalization (i18n) module’s i18n node submodule in Drupal allows a user possessing both “Translate content” and “Administer content translations” permissions to view and attach unpublished nodes through the translation user interface and its autocomplete widget. This circumvents intended access controls, potentially disclosing unpublished node titles and IDs. The issue arises due to insufficient access checks when handling node translations.

Recommendations Update to a version beyond 7.x-1.35.

Exploit

Correção

Improper Access Control

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-284

CWE-276

Identificadores relacionados

CVE-2026-0748

Produtos afetados

Drupal

I18N Module

I18N Node Submodule

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0748.json · Exploit
• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-0748 · Exploit
• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7 · Exploit
• https://d7es.tag1.com/node/86 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-0748 · Nota de Segurança
• https://drupal.org/project/i18n · Nota
• https://twitter.com/CVEnew/status/2037280511346049095 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-0748 · Aviso do Fabricante
• https://git.drupalcode.org/project/i18n · Nota