PT-2026-28309 · Unknown+1 · I18N Node Submodule+2

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-0748

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Drupal versions 7.x-1.0 through 7.x-1.35

Description The Internationalization (i18n) module’s i18n node submodule in Drupal allows a user possessing both “Translate content” and “Administer content translations” permissions to view and attach unpublished nodes through the translation user interface and its autocomplete widget. This circumvents intended access controls, potentially disclosing unpublished node titles and IDs. The issue arises due to insufficient access checks when handling node translations.

Recommendations Update to a version beyond 7.x-1.35.

Exploit

Fix

Incorrect Default Permissions

Improper Access Control

Weakness Enumeration

CWE-276

CWE-284

Related Identifiers

CVE-2026-0748

Affected Products

Drupal

I18N Module

I18N Node Submodule

References · 5

• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7 · Exploit
• 🔥 https://herodevs.com/vulnerability-directory/cve-2026-0748 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-0748 · Security Note
• https://twitter.com/CVEnew/status/2037280511346049095 · Twitter Post
• https://d7es.tag1.com/node/86 · Note