Missing Authorization in the Ágora Transparency Theme allows forceful browsing of URLs that should be protected, enabling an attacker to view sensitive data or configuration details that are not intended for public consumption. The flaw is a classic lack of access control, meaning that any user who can guess or determine a valid endpoint can retrieve data. The consequence is loss of confidentiality for content served by the theme, which could include user data or site configuration. The specific weakness is identified as CWE‑862, highlighting that the vulnerability arises from improper authorization enforcement.

Drupal installations that use the Ágora Transparency Theme, specifically any version from 0.0.0 through 1.2.3 inclusive. All sites currently running any of these versions are potentially affected until a patch replaces the vulnerable theme component.

The Advisory does not provide an EPSS score, so the exact exploitation probability cannot be quantified, but the nature of the flaw—missing authorization—means that a remote attacker who can access the site's web interface can directly request disallowed URLs and trigger the disclosure. There is no listing in the CISA KEV catalog, but the vulnerability is documented in the Drupal security advisory SA‑CONTRIB‑2026‑231. Given the ease of traversal and the lack of input on mitigation, the risk level is moderate to high, warranting prompt action. The likely attack vector is purely remote via the website, and no additional prerequisites beyond the ability to access the host's web service are required.