CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
What the vulnerability does
In the Drupal 7 Internationalization (i18n) module, the i18n_node submodule allows a user with both "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes via the translation UI and its autocomplete widget. This bypasses intended access controls and discloses unpublished node titles and IDs. Exploit affects versions 7.x-1.0 up to and including 7.x-1.35.
Explanation of Vulnerability in Simple Terms
The i18n_node submodule in Drupal's Internationalization module versions 7.x-1.0 through 7.x-1.35 contains an access control flaw. A logged-in user with low privileges can access or modify content they should not have permission to view or edit. The vulnerability requires an active user account but no special interaction from other users.
What an attacker can do
Access or modify content that should be restricted to higher-privilege users.
Potential impact on your site
Unauthorized users may read or alter multilingual node content beyond their assigned permissions.
Conditions required to exploit
Attacker must have a low-privilege user account on the Drupal site.
Key dates
External resources
Related vulnerabilities
