CVE-2026-84913 in AI Translate Plugin
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing. This issue affects AI Translate versions: from 0.0.0 to 1.3.2, from 1.4.0 to 1.4.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The Drupal module known as AI Translate contains a critical access control flaw that permits unauthorized users to perform forceful browsing against sensitive administrative endpoints and translation services. This vulnerability stems from an insufficient authorization check within the application logic, allowing attackers who possess valid credentials or even unauthenticated users in certain configurations to directly invoke internal API routes intended for privileged operations. By manipulating URL parameters or request paths associated with the AI Translate functionality, a malicious actor can bypass standard permission checks that are supposed to restrict access based on user roles and permissions assigned by the site administrator. This type of flaw is classically categorized under CWE-284 Improper Access Control, specifically reflecting failures in enforcing restrictions on what authenticated users are allowed to do, which often manifests as forceful browsing where an attacker iterates through known or guessed URLs to access restricted resources without proper verification of their authority to view or modify that data.
The operational impact of this vulnerability is significant for any Drupal site relying on AI Translate for content localization and translation workflows. Because the module handles potentially sensitive multilingual content, unauthorized access could lead to the exposure of draft translations, proprietary terminology databases, or internal configuration settings related to third-party artificial intelligence services such as Google Cloud Translation or Microsoft Azure Translator API keys if they are exposed through these endpoints. Furthermore, an attacker with sufficient privileges gained through this bypass might be able to alter translation configurations, inject malicious prompts into AI-driven translation processes, or disrupt the integrity of localized content by modifying source strings before they are processed. This not only compromises confidentiality but also threatens data integrity and availability within the web application environment.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Discovery and Collection, where adversaries probe systems for accessible resources that can be leveraged for further exploitation or information gathering. The lack of robust server-side validation on route access allows attackers to enumerate internal structures effectively. To mitigate this risk, site administrators should immediately update the AI Translate module to a version later than 1.4.1 if available, as these updates typically include patches that enforce strict role-based access control checks before processing any requests related to translation services. Additionally, implementing web application firewalls with rules designed to detect and block abnormal patterns of URL traversal or unauthorized API calls can provide an additional layer of defense while the underlying code is being remediated. Regular security audits focusing on authorization logic in custom modules are also recommended to prevent similar access control bypasses in other parts of the Drupal installation.