Missing authorization in Drupal TinyPNG allows forceful browsing, enabling an attacker to access resources that should be protected and potentially disclose confidential data. The weakness stems from a failure to enforce proper access controls (CWE-862) and can lead to moderate or significant data exposure depending on the sensitivity of the accessed content.

The vulnerability affects the Drupal TinyPNG module across all released versions from 0.0.0 through 2.0.2. Deployments using these versions are susceptible to the described forceful browsing issue.

The CVE lacks a published CVSS score and EPSS data, and it is not listed in the CISA KEV catalog, indicating no public exploitation evidence to date. Based on the description, the likely attack vector is remote, with an attacker manually requesting URLs that bypass normal authorization. The risk remains significant for organizations that expose sensitive data via the module, and the impact can range from moderate to severe depending on the protected resources involved.