{"id":"CVE-2026-0748","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-0748","generatedAt":"2026-10-28T00:18:37.963Z","title":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete…","description":"In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both \"Translate content\" and \"Administer content translations\" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. \n\nExploit affects versions 7.x-1.0 up to and including 7.x-1.35.","published":"2026-03-26T22:16:27.000Z","lastModified":"2026-06-17T10:11:19.000Z","status":"Analyzed","sourceIdentifier":"mlhess@drupal.org","cvss":{"version":"4.0","score":5.3,"severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-284","CWE-276"],"affected":["internationalization project/internationalization"],"epss":{"score":0.00421,"percentile":0.3619,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.42%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://d7es.tag1.com/node/86","tags":["Third Party Advisory"],"source":"mlhess@drupal.org"},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-0748","tags":["Exploit","Third Party Advisory"],"source":"mlhess@drupal.org"},{"url":"https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7","tags":["Exploit","Third Party Advisory"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-0748","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}