CVE-2026-0748

Katalog CVE

CVSS 4.3 · Medium EPSS 0,40%

Kerentanan Improper Access Control pada internationalization project internationalization. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-276: Incorrect Default Permissions

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://d7es.tag1.com/node/86 advisory pihak ketiga
• https://www.herodevs.com/vulnerability-directory/cve-2026-0748 exploit · advisory pihak ketiga
• https://www.herodevs.com/vulnerability-directory/cve-2026-0748?nes-for-drupal-7 exploit · advisory pihak ketiga