CVE-2026-84912: Drupal AI Translate Module Access Bypass Vulnerability
Summary
CVE-2026-84912: This submodule AI Translate enables you to automatically translate entities. Affects drupal/ai across 2 version ranges.
< 1.3.13
>= 1.4.0, < 1.4.8
Fixed in 1.3.13 or 1.4.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AI Translate module for Drupal is designed to facilitate automatic translation of entities within the Drupal content management system. This module allows users to translate various content types seamlessly, enhancing multilingual support. However, it has been identified that the module does not adequately enforce access controls on entities being translated, which can lead to unauthorized access during translation operations.
Vulnerability Detail
The vulnerability arises from insufficient access checks on the entities being translated, as well as their related fields and referenced entities. When performing an AI translation, the module fails to verify if the user has the appropriate permissions for these entities, especially when they have different access levels than the parent entity. This permission bypass is limited to translation operations and does not extend to unauthorized read or update access, but it still poses a significant risk of misuse.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.131.3.13 -
>= 1.4.0, < 1.4.81.4.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, administrators can restrict access to the AI Translate module for users who should not have translation capabilities. This can be done by adjusting user roles and permissions in the Drupal admin interface.
Conclusion
The CVE-2026-84912 vulnerability in the Drupal AI Translate module highlights a critical access control issue that could allow unauthorized translations. It is essential for users to update to the latest patched versions to mitigate this risk. Additionally, implementing temporary access restrictions can help safeguard against potential misuse until an update can be applied.
See every vulnerability recorded for drupal/ai →
FAQ
The AI Translate module is a Drupal extension that automates the translation of content entities, making it easier for users to manage multilingual websites.
The vulnerability allows users to bypass access controls when translating entities, potentially leading to unauthorized translations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider restricting access to the module for users who should not perform translations as a temporary workaround.
Detailed information about this vulnerability can be found in the Drupal security advisory and the official GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/ai.
