The vulnerability is a missing authorization flaw present in Drupal Commerce Core that permits forceful browsing. Attackers can request URLs that normally require authentication or elevated privileges, potentially exposing sensitive order data, customer information, or internal inventory data. This flaw constitutes an access bypass and could lead to data disclosure.

Affected are all releases of Drupal Commerce Core from 0.0.0 through 2.41 and from 3.0.0 through 3.3.13. Administrators of storefronts and backend portals using these versions should immediately verify their installed version against the advisory and apply any available fix.

The CVSS score is not provided but the advisory labels the issue as highly critical, indicating substantial confidentiality and integrity impact. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so current exploitation probability is uncertain. Attackers could exploit this flaw remotely by sending crafted HTTP requests to non‑public resource paths, so the risk remains high until a patch is in place.