The vulnerability is a Missing Authorization flaw (CWE‑862) in the Drupal Swiper formatter that permits forceful browsing of content. An attacker who can trigger the formatter may access files, configuration data, or other sensitive information that should be restricted to authorized users. The exploit can lead to confidentiality loss of private site data.

Drupal Swiper formatter is impacted. Versions from 0.0.0 through 2.1.2, and from 3.0.1 through 3.1.0 are vulnerable. Any installation using these versions, regardless of the underlying Drupal core version, must be examined for potential exposure.

The CVE lacks an EPSS score and is not listed in the CISA KEV catalog, suggesting that it has not yet been exploited in the wild or is considered lower priority by security agencies. Nevertheless, the flaw grants direct access to protected content and can be abused via normal web requests to the formatter endpoint. The absence of an EPSS figure does not eliminate risk; organizations handling sensitive material should treat the vulnerability as a moderate‑to‑high risk depending on exposure level.