The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content (a node). In that process the existing node’s content was copied into the new node’s submission form.
The module contained a flaw that allowed a user with the ‘translate content’ permission to potentially bypass normal viewing access restrictions, for example allowing the user to see the content of unpublished nodes even if they did not have permission to view unpublished nodes.
Part of security release SA-CORE-2009-001
This vulnerability affects the following application versions:
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8