DRUPAL-CONTRIB-2026-121unknown
DRUPAL-CONTRIB-2026-121
The advisory, in context
This module enables you to automatically translate entities.
The module doesn't sufficiently check access on the entity to be translated, related fields or referenced entities when performing an AI translation on an entity or when those fields / entities have a different access level than the parent entity. This permission bypass is only applicable to the translate operation - no unwarranted read or update access is granted to the affected entities
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/ai_translate Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.3.2
Fixed in 1.3.2
Ecosystem versions
From 1.4.0 before 1.4.1
Fixed in 1.4.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.3.2"
}
},
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.4.1"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": ">=1.4.0 <1.4.1"
}
}
],
"versions": []
}