CVE-2026-84913: Drupal AI Translate Module Access Bypass Vulnerability
Summary
CVE-2026-84913: This module enables you to automatically translate entities. Affects drupal/ai_translate across 2 version ranges.
< 1.3.2
>= 1.4.0, < 1.4.1
Fixed in 1.3.2 or 1.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'ai_translate' module for Drupal facilitates automatic translation of entities, enhancing multilingual capabilities for websites. It allows users to translate content seamlessly, but it has been identified that the module does not adequately enforce access controls on entities and their related fields during the translation process. This oversight can lead to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability arises from insufficient access checks when performing AI translations on entities. Specifically, the module fails to verify whether the user has the appropriate permissions for the entity being translated or for any related fields and referenced entities. This permission bypass is limited to the translation operation, meaning that while unauthorized translations can occur, no additional read or update access is granted to the affected entities. This could potentially expose sensitive information to users who should not have access.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.3.21.3.2 -
>= 1.4.0, < 1.4.11.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the translation functionality by modifying user permissions until the module is updated. Ensure that only trusted users have access to translation features.
Conclusion
The CVE-2026-84913 vulnerability in the Drupal 'ai_translate' module poses a risk of unauthorized access to translation features due to inadequate access checks. Users are advised to update to the latest patched version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for drupal/ai_translate →
FAQ
CVE-2026-84913 is a vulnerability in the Drupal 'ai_translate' module that allows unauthorized access to translation features due to insufficient access checks.
If you are using versions of the 'ai_translate' module below 1.3.2 or between 1.4.0 and 1.4.1, your site is vulnerable. You can check your version in the module's configuration settings.
If an immediate update is not possible, restrict access to the translation features for users who should not have permission to translate entities.
Detailed information about CVE-2026-84913 can be found in the advisory published by the Drupal Security Team and on vulnerability databases.
Vulert monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json. You can use the Vulert playground to check if your application is affected by this vulnerability without any signup.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
