CVE-2026-0748

low-risk

Published 2026-03-26

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.3/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Internationalization

Affected Vendors

Internationalization Project

References (3)

Third Party Advisory https://d7es.tag1.com/node/86

Exploit https://www.herodevs.com/vulnerability-directory/cve-2026-0748

Exploit https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal