EUVD-2026-16420
GHSA-qwjq-cprg-rrcp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Real-world risk is moderate but context-dependent. No CVSS score or vector was provided, preventing quantitative assessment of attack complexity, attack vector, or privilege escalation potential; however, the vulnerability requires two specific permissions ('Translate content' AND 'Administer content translations'), limiting the threat actor population to authenticated users with elevated translation roles. No KEV (CISA Known Exploited Vulnerabilities) status, EPSS score, or public proof-of-concept exploit was identified in available intelligence, indicating no confirmed active exploitation in the wild. The impact is information disclosure (unpublished node IDs and titles), not remote code execution or data modification. For sites with restrictive permission delegation (i.e., few users granted both translation permissions), risk is lower; for sites with looser permission models, the risk increases moderately. The lack of active exploitation signals does not negate the need for patching, as the vulnerability is reliable and straightforward to exploit for users already holding the requisite permissions. |
| Exploit ScenarioDerived | A site administrator grants both 'Translate content' and 'Administer content translations' permissions to a content editor responsible for multilingual content management. The editor discovers they can use the content translation interface to search for and attach unpublished nodes in translation workflows, revealing draft article titles and node IDs that should remain hidden from their role. The editor could then leverage this information to gain insight into upcoming content or organizational plans not yet publicly released, or use node IDs to manually construct admin URLs to attempt further access escalation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
The Drupal 7 Internationalization (i18n) module's i18n_node submodule allows authenticated users holding both 'Translate content' and 'Administer content translations' permissions to bypass access controls and view unpublished node titles and IDs through the translation user interface and autocomplete functionality. Affected versions range from 7.x-1.0 through 7.x-1.35. No public exploit code or active exploitation has been confirmed at the time of analysis.
RemediationAI
Upgrade the i18n module to a patched version beyond 7.x-1.35 as soon as a security release is available from the Drupal project. Monitor the official Drupal security advisories and the Hero Devs vulnerability directory (https://www.herodevs.com/vulnerability-directory/cve-2026-0748) for patch availability and release notes. Until an official patch is released, restrict the assignment of both 'Translate content' and 'Administer content translations' permissions to trusted administrator-level users only, and audit existing permission assignments to identify and revoke dual-permission grants from non-essential accounts. Consider implementing a code review or custom access control layer in the i18n_node module if an extended delay in patch availability is anticipated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The i18n module (CPE: cpe:2.3:a:drupal:internationalization_(i18n)_-_i18n_node_submodule:*:*:*:*:*:*:*:*) extends Drupal 7's content translation capabilities. The vulnerability stems from improper access control validation in the i18n_node submodule, specifically in how the translation UI and its autocomplete widget handle node references. CWE-284 (Improper Access Control-Permissions, Privileges, and Other Access Controls) identifies the root cause: the module fails to properly enforce the distinction between published and unpublished nodes during translation operations, allowing users with specific translation permissions to circumvent the standard node access checks. This occurs because the autocomplete and node attachment mechanisms do not re-verify publication status after permission checks pass.
Know when Internationalization I18N I18N Node Submodule gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs.
Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.
Executive ViewAI
CVE-2026-0748 presents moderate security risk, a improper access control vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB