The vulnerability is an incorrect authorization flaw that permits forceful browsing of protected resources in Drupal SmartLinker AI, allowing any user who can send HTTP requests to discover URLs for sensitive content and expose confidential data. The weakness is classified as CWE-863, representing an authorization failure.

SmartLinker AI – Drupal module versions from 0.0.0 up to 1.0.3 are affected. Sites that have not upgraded beyond 1.0.3 are susceptible, regardless of the user’s authenticated status.

No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the exact exploitation likelihood remains uncertain. However, the flaw allows remote HTTP requests that bypass authorization checks, making it easy to test and potentially high impact in a widely deployed Drupal environment. The CVSS score is not specified, but the advisory indicates a moderately critical level of risk. Attackers could remotely expose sensitive content to anyone with network access to the web server.