Incorrect Authorization within the Drupal Restrict route by IP module allows an attacker to forcefully browse to routes that should be restricted, potentially exposing sensitive content. The flaw, classified as CWE‑863, permits bypass of the intended IP-based access control and can be exploited by any user who can generate HTTP requests to the affected routes.

Drupal websites that have installed the Restrict route by IP module, specifically versions ranging from 0.0.0 through 1.3.1 and from 2.0.0 through 2.0.1.

The vulnerability is marked Critical in its advisory, but no EPSS score is available and it is not listed in CISA KEV. Presumably the attack requires the ability to send crafted web requests to the target Drupal site; no prerequisite authentication is required. Because the flaw resides in the module configuration rather than in the core Drupal code, it is likely exploitable by external actors without elevated privileges as long as the affected routes remain reachable.