CVE-2026-0748: Drupal i18n Module Auth Bypass Vulnerability

CVE-2026-0748 Overview

CVE-2026-0748 is an access control bypass vulnerability in the Drupal 7 Internationalization (i18n) module. The i18n_node submodule improperly allows users with "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes through the translation UI and its autocomplete widget. This vulnerability enables unauthorized disclosure of unpublished node titles and IDs, bypassing intended content visibility controls.

Critical Impact

Attackers with translation-related permissions can access unpublished content metadata, potentially exposing sensitive draft content, scheduled publications, or confidential information stored in unpublished nodes.

Affected Products

• Drupal 7 Internationalization (i18n) module versions 7.x-1.0 through 7.x-1.35
• Drupal 7 sites using the i18n_node submodule with content translation features
• Installations where users have combined "Translate content" and "Administer content translations" permissions

Discovery Timeline

• 2026-03-26 - CVE-2026-0748 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-0748

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control). The flaw exists in how the i18n_node submodule handles access checks when users interact with the translation user interface. When a user with translation permissions attempts to add or manage translations for content, the autocomplete widget fails to properly verify whether the user has permission to view the nodes being suggested.

The vulnerability occurs because the translation UI's autocomplete functionality queries the node database without applying the standard Drupal node access checks. This means that unpublished nodes—which should only be visible to users with explicit "view unpublished content" permissions—are exposed through the translation interface.

Root Cause

The root cause lies in insufficient access control validation within the i18n_node submodule's translation attachment logic. The autocomplete endpoint that suggests nodes for translation linking does not call node_access() or equivalent permission checks before returning node titles and IDs to authenticated users with translation permissions.

Specifically, the submodule assumes that users with "Administer content translations" permissions should have unrestricted access to all nodes for translation purposes. However, this creates a privilege escalation path where translation-focused permissions inadvertently grant read access to unpublished content metadata.

Attack Vector

An authenticated attacker with "Translate content" and "Administer content translations" permissions can exploit this vulnerability through the following mechanism:

1. Navigate to the content translation interface within the Drupal administration area
2. Access the autocomplete widget used to select nodes for translation linking
3. The widget returns unpublished node titles and node IDs in its suggestions
4. The attacker can enumerate unpublished content and potentially attach translations to nodes they should not be able to access

The vulnerability requires network access and authenticated permissions, but those permissions are commonly granted to content editors and translators who should not have access to all unpublished content on the site. The attack surface is particularly concerning in multi-author or enterprise Drupal installations where content workflow and access restrictions are critical.

Detection Methods for CVE-2026-0748

Indicators of Compromise

• Unusual activity in translation administration logs from users querying or attaching translations to content they did not author
• Autocomplete requests to translation endpoints returning large numbers of unpublished node references
• Users with only translation permissions accessing node IDs that belong to restricted or unpublished content
• Audit log entries showing translation attachments to nodes the user has no authorship or editorial relationship with

Detection Strategies

• Review Drupal watchdog logs for translation-related autocomplete queries that return unpublished node data
• Implement custom logging on the i18n_node translation endpoints to track which nodes are being queried
• Monitor user permission combinations that include both "Translate content" and "Administer content translations"
• Audit translation table entries for unexpected relationships between translators and content they should not access

Monitoring Recommendations

• Enable detailed logging for the Internationalization module's administrative functions
• Configure alerts for bulk autocomplete queries on translation endpoints
• Regularly audit user permissions to ensure translation-related roles do not inadvertently grant broader content access
• Implement content access logging to track which users view or interact with unpublished content metadata

How to Mitigate CVE-2026-0748

Immediate Actions Required

• Upgrade the Drupal 7 Internationalization (i18n) module to a patched version beyond 7.x-1.35 when available
• Review and restrict users who have both "Translate content" and "Administer content translations" permissions
• Consider temporarily disabling the i18n_node submodule if translation features are not critical to operations
• Audit existing translation data to identify any unauthorized access to unpublished content

Patch Information

Consult the official security advisories from the Drupal community and the module maintainers for patch availability. Additional information can be found at the Tag1 Node Resource and the HeroDev CVE-2026-0748 Directory Entry.

Organizations running end-of-life Drupal 7 should prioritize migration to supported versions or engage extended support vendors for security updates.

Workarounds

• Restrict "Administer content translations" permission to only highly trusted administrators until a patch is applied
• Use Drupal's role-based access control to separate translation permissions from content administration
• Implement custom access checks on translation-related endpoints using a custom module
• Consider using the Content Access or Node Access modules to add additional protection layers for unpublished content
• Monitor translation activity closely and review access logs regularly for suspicious behavior