This vulnerability is a Missing Authorization flaw that permits forceful browsing, allowing a user to navigate to URLs that should be restricted. An attacker can potentially view, download, or manipulate content that the system should protect, leading to confidentiality or integrity compromise for any data exposed through those URLs. The weakness is identified as CWE-862.

Drupal:DKAN instances running any version from 0.0.0 up to 4.0.4 inclusive, and from 4.1.0 up to 4.1.5 inclusive, are affected. Versions 4.1.6 and newer are not listed as vulnerable.

The CVSS score is not disclosed and EPSS data is unavailable, so the precise severity and exploitation likelihood cannot be quantified from the available data. However, the flaw gives privileged access to content that should remain protected. Because the vulnerability is discovered through the Drupal security advisory system, it is presumed that an attacker can exploit it by issuing crafted HTTP requests without needing authentication. Since the vulnerability is not listed in CISA’s KEV catalog, it has no known public exploits at the time of this analysis, but that does not diminish the risk of an attacker discovering and applying the exploitation path.