The vulnerability is an incorrect authorization flaw (CWE-863) in the Drupal Fullcalendar View module, identified as a forceful browsing issue. An attacker unable to perform a valid authorization check can bypass access controls and view content that should be restricted, potentially exposing sensitive information.

Systems running Drupal Fullcalendar View versions from 0.0.0 through 5.2.6 are affected. The vendor is the Drupal project, and the specific module in question is Fullcalendar View.

The vulnerability has no EPSS score available and is not listed in the CISA KEV catalog, indicating limited or no publicly known exploitation. The likely attack vector is remote, via the Drupal site's web interface, where an attacker could access the Fullcalendar View module's endpoints without proper authorization. The flaw permits unauthorized viewing of content that should be protected, but there is no evidence of code execution or full system compromise based on the data provided.