[IT-SecNots] [Security-news] AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-121

Project: AI translate [1]
Date: 2026-September-02
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Access Bypass

Affected versions: <1.3.2 || >=1.4.0 <1.4.1
CVE IDs: CVE-2026-84913
Description: 
This module enables you to automatically translate entities.

The module doesn't sufficiently check access on the entity to be translated,
related fields or referenced entities when performing an AI translation on an
entity or when those fields / entities have a different access level than the
parent entity. This permission bypass is only applicable to the translate
operation - no unwarranted read or update access is granted to the affected
entities

Solution: 
Install the latest version:

 * If you use AI Translate 1.3.x, upgrade to AI Translate 1.3.2 [3]
 * If you use AI Translate 1.4.x, upgrade to AI Translate 1.4.1 [4]

Reported By: 
 * Marcus Johansson (marcus_johansson) [5]

Fixed By: 
 * Artem Dmitriiev (a.dmitriiev) [6]
 * Marcus Johansson (marcus_johansson) [7]
 * Sven Decabooter (svendecabooter) [8]
 * Valery Lourie (valthebald) [9]

Coordinated By: 
 * Swan Kalata (akalata) [10] of the Drupal Security Team
 * Greg Knaddison (greggles) [11] of the Drupal Security Team
 * Juraj Nemec (poker10) [12] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [13]

[1] https://www.drupal.org/project/ai_translate
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/ai_translate/releases/1.3.2
[4] https://www.drupal.org/project/ai_translate/releases/1.4.1
[5] https://www.drupal.org/u/marcus_johansson
[6] https://www.drupal.org/u/admitriiev
[7] https://www.drupal.org/u/marcus_johansson
[8] https://www.drupal.org/u/svendecabooter
[9] https://www.drupal.org/u/valthebald
[10] https://www.drupal.org/u/akalata
[11] https://www.drupal.org/u/greggles
[12] https://www.drupal.org/u/poker10
[13]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3618946

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at