The vulnerability in the Drupal 7 Internationalization i18n module’s i18n_node submodule allows a user who holds both the "Translate content" and "Administer content translations" permissions to view and attach unpublished nodes through the translation UI and its autocomplete widget. This bypasses normal access controls, exposing unpublished node titles and identifiers to those users. The weakness lies in insufficient permission checks before exposing unpublished content, which aligns with CWE-276 and CWE-284.

All Drupal 7 sites that have the i18n module installed between versions 7.x-1.0 and 7.x-1.35 are affected. The issue is limited to the i18n_node submodule of the Internationalization project and applies to any Drupal 7 instance that includes this module in that version range.

The CVSS score of 5.3 indicates a moderate severity level. With an EPSS score below 1% and no presence in the CISA KEV catalog, the overall likelihood of exploitation is low, although not negligible. The probably attack vector is through the web-based translation interface, where an authenticated user with the required permissions could trigger the information disclosure by accessing the autocomplete functionality. No external preconditions beyond existing permissions are needed for exploitation.