The vulnerability is an Incorrect Authorization flaw that enables Forceful Browsing within Drupal Rabbit Hole. An attacker who can send crafted requests can bypass normal access controls and retrieve content or configuration data that should be restricted. This type of bypass can lead to disclosure of proprietary or sensitive information and may compromise site integrity. The weakness is associated with CWE-863, which focuses on insufficient Authorization.

Drupal Rabbit Hole, affecting all releases from 0.0.0 up to and including 1.3.0. Any Drupal installation that includes these module versions is vulnerable. The problem does not affect other Drupal components unless they integrate user access checks with Rabbit Hole directly.

The lack of a specified CVSS score or EPSS score limits precise severity quantification. However, the described access bypass can allow unauthenticated or low‑privilege attackers to view restricted content, which may be considered a moderate to high risk depending on the sensitivity of the data. Because the bug relies on standard HTTP requests, it is likely exploitable remotely without additional credentials. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation at the time of reporting.