The vulnerability in Drupal's i18n_node submodule arises from improper access control (CWE-284). Users granted both "Translate content" and "Administer content translations" permissions can access unpublished nodes via the translation interface, exposing unpublished content metadata that should remain restricted. This issue affects Drupal 7 Internationalization module versions from 7.x-1.0 up to and including 7.x-1.35. The CVSS 4.0 base score is 5.3, indicating a medium severity level. No patch or official remediation details are provided in the available information.

The vulnerability leads to unauthorized disclosure of unpublished node titles and IDs to users who have specific translation-related permissions. This could result in information leakage of content that is not yet published or intended for public or broader internal access. There is no indication of privilege escalation, code execution, or data modification from the provided data.

Patch status is not yet confirmed — check the Drupal vendor advisory for current remediation guidance. Until a fix is available, review and restrict the combination of permissions "Translate content" and "Administer content translations" to trusted users only to limit exposure. Monitor official Drupal security channels for updates or patches addressing this issue.