Drupal's Frontend Editing module contains an incorrect authorization flaw that permits Forceful Browsing. Attackers can request URLs that should be protected, allowing them to view content meant for authenticated users or administrative pages. This is an authorization bypass that may expose sensitive data and obscure content integrity. The core weakness is described by CWE-863, indicating improper authorization checks.

The flaw affects the Frontend Editing contributed module for Drupal. Versions from 0.0.0 through 1.9.3 are affected, covering all releases up to the latest listed version. Users running any of these versions should verify whether the module is installed and in use and determine the specific level of access granted to their roles.

Because no EPSS or KEV data is available, the public knowledge of exploitation is limited, but the vulnerability can be used without authentication through directed URL requests. Without the proper authorization check, an attacker can forcefully browse protected pages. While the severity is not quantified in CVSS terms, the potential to expose confidential content requires prompt remediation. The attack path is relatively straightforward once the module is active: sending crafted HTTP requests to restricted endpoints reveals the bypass.