The issue is an incorrect authorization flaw in the Drupal View Unpublished module that permits forceful browsing. The flaw, identified as CWE‑863, allows an attacker to access content that should remain restricted, thereby breaching confidentiality. Depending on the content that is exposed, this could lead to strategic or sensitive data disclosure.

Drupal View Unpublished module, versions ranging from 0.0.0 up to and including 1.5.0, is affected. Any site deploying these versions of the module is vulnerable.

The CVE is described as moderately critical, suggesting a serious impact if exploited. No CVSS score is supplied, and the EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability was not listed in the CISA KEV catalog. The attack vector is inferred to be remote, via the web interface, as forceful browsing typically requires a web request to a protected resource. Attackers would need some identifier of unpublished content, which could be enumerated or guessed, to take advantage of the flaw.