Drupal Domain for versions 3.0.0 through 3.0.2 contains an incorrect authorization flaw that permits forceful browsing. An attacker can request URLs that should require authentication, thereby exposing restricted content or administrative functionality. This broken access control can lead to unauthorized data disclosure or manipulation of domain configuration.

The vulnerability affects the Domain module developed by the Drupal community. Only installations of Drupal Domain version 3.0.0 up to and including 3.0.2 are impacted. Substituting a later stable release mitigates the underlying code flaw.

The CVE does not provide an EPSS score or CVSS baseline, and it is not listed in the CISA KEV catalog, indicating a moderate threat level under current data. The likely attack vector is remote, where an attacker crafts or traverses URLs to reach protected domains without valid credentials. Exploitation requires only network access to the Drupal site, and no additional local privileges are needed. The absence of an EPSS score suggests low yet non-zero risk of exploitation in the wild, but the broken access control remains a substantial risk to confidentiality and integrity if left unpatched.