An incorrect authorization check in Drupal Simple User Management permits forceful browsing, allowing a user to construct requests to arbitrary user identifiers without required permissions and view protected user data. The flaw is a classic authorization failure (CWE‑863). The impact is the unauthorized disclosure of user information and potentially other protected resources accessible through the user profile endpoints.

Drupal Simple User Management is affected in all releases from 0.0.0 through 1.11.0. The vulnerability exists in the user management module supplied by the Drupal project and applies to installations that expose the user profile routes without additional access restriction.

The vulnerability is exploitable remotely through web requests and does not require authentication, meaning anyone with web access can craft URLs to retrieve any user's data. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalog. Given the lack of an official patch in the data, the risk remains significant until a fix is released; administrators should treat this as a moderate‑critical issue and act promptly.