The vulnerability is an Incorrect Authorization flaw that permits forceful browsing of media resources. Users without proper permissions can guess URLs or use predictable patterns to access protected media items, potentially exposing confidential content. The weakness is a classic access bypass problem, which could allow attackers to view, download, or manipulate media that should be restricted.

Affected software is the Drupal Media Bulk Upload module for all versions from 0.0.0 through 3.0.6. The module is used by Drupal sites to upload and manage large collections of media, but the current releases incorrectly enforce access checks.

Because the vulnerability is web‑based and relies only on predictable URLs, it is relatively easy to exploit for any party that can reach the site. No CVSS or EPSS score is provided, and the issue is not listed in CISA KEV, indicating no documented large‑scale exploitation yet. Nonetheless, the risk of data exposure and privilege escalation remains medium to high for sites that rely on Media Bulk Upload and host sensitive media. An attacker could use the flaw to obtain private media, which may lead to reputational damage or legal exposure if the content is regulated.