The Drupal Group invite module suffers from an Improper Check for Unusual or Exceptional Conditions flaw that allows forceful browsing of group resource URLs. This can let an attacker sidestep normal group membership checks and view or retrieve content intended for authorized group members only. The weakness is classified as CWE‑754 and results in a moderate violation of confidentiality and integrity for group information.

The vulnerability affects installations of the Drupal Group invite module with versions from 0.0.0 up to, but not including, 2.3.9, from 3.0.0 up to, but not including, 3.0.4, and from 4.0.0 up to, but not including, 4.0.4. Any Drupal site that has the Group invite module in these affected ranges is susceptible.

The CVSS score of 5.3 denotes a medium risk, while the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The probable attack path involves manipulating group URLs to force the application to serve pages it normally restricts; the need for authentication is inferred rather than stated explicitly in the advisory. No public exploitation has been reported at this time.