The vulnerability is an incorrect authorization flaw that allows an attacker to forcefully browse URLs within Dopup, exposing information that should be protected. This flaw is categorized as CWE‑863 and can lead to the unintended disclosure of data to unauthenticated users. The main consequence is the loss of confidentiality of content that is meant to be restricted to authorized roles, potentially including private user data, configuration files, or other sensitive resources reserved for higher‑privilege users.

Drupal Dopup is affected in all releases from version 0.0.0 through 1.0.7. Users of any of these versions, regardless of the deployment size or configuration, may be exposed to the vulnerability. The product is a Drupal contrib module, so any site that has installed it in the stated version range is at risk.

No CVSS or EPSS metrics are provided for this entry, and the vulnerability is not listed in CISA’s KEV catalog. The advisory labels it as critical, indicating that once the flaw is exploitable, the impact is severe. The likely attack vector is that any web user who can craft arbitrary URLs to the Dopup module can trigger the error; there are no remote code execution or elevated privilege prerequisites noted. Because exploitation requires only the ability to send HTTP requests to the module, the risk chances are high once the software is in use on a publicly exposed or internal network.