The Drupal AI File to Text module implements an authorization check that is incorrectly enforced, allowing a process of forceful browsing. This permission bypass flaw (CWE‑863) can enable an attacker to request URLs that should be protected, resulting in the retrieval of files or data that the module is intended to restrict. The flaw is present in all releases from 0.0.0 to 1.0.1 inclusive.

All installations of the Drupal AI File to Text module with versions 0.0.0 through 1.0.1, regardless of the underlying Drupal core version, are affected because the faulty authorization logic resides entirely within the module itself.

No public EPSS score or entry in the CISA KEV catalog has been reported, so the likelihood of exploitation remains uncertain. The vulnerability is exploitable via remote HTTP requests without the need for privileged credentials, indicating a remote and unauthenticated attack vector. Given the potential to expose protected files or data, the risk can be regarded as moderate to high, especially in environments where the module processes sensitive or confidential content. Prompt remediation is recommended to mitigate the risk of unauthorized data exposure.