Missing Authorization in Drupal Easy Breadcrumb allows forceful browsing, enabling any authenticated or unauthenticated user to view privileged content without proper permission checks, leading to potential disclosure of sensitive data. The weakness is rooted in CWE-862, a classic missing authorization flaw. Attackers could navigate to protected breadcrumb URLs to retrieve information that is otherwise restricted to specific roles.

The vulnerability impacts Drupal Easy Breadcrumb, versions ranging from 0.0.0 through 2.0.11. Any Drupal installation deploying these versions and permitting browsing of breadcrumb paths is at risk.

The problem is not listed in the CISA KEV catalog, and an EPSS score is not provided, implying limited known exploitation data. The CVSS score is not disclosed in the current feed; however, the description highlights a moderate severity, suggesting that while exploitation is straightforward, the overall risk depends on the exposure of sensitive content. The attack vector appears to be remote and requires no additional privileges beyond normal browsing access, making it potentially exploitable from any network location that can reach the site.