This vulnerability stems from an incorrect authorization check in Drupal Commerce Core that permits users to forcefully view restricted content. An attacker who can guess or enumerate URLs can access confidential data, potentially disclosing sensitive commercial information. The weakness is categorized as CWE‑863, which signifies improper privilege management allowing access beyond intended authorization boundaries.

The affected product is Drupal Commerce Core for the Commerce Core module. Drupal maintainers list affected releases as all versions from 0.0.0 up to and including 2.41, as well as releases 3.0.0 through 3.2.0. All other versions are not known to be impacted.

The vulnerability could be exploited through web requests targeting normally restricted URLs; the exact prerequisites are not detailed in the advisory, but the forceful browsing characteristic implies that the attacker needs only to discover a valid URL path. No public exploit code or proof‑of‑concept is cited, and the EPSS score is unavailable, while the vulnerability is not currently listed in the CISA KEV catalog. Consequently, the risk is moderate to high: potential loss of confidential data, but limited to the scope of the Drupal Commerce Core application and dependent on user permission levels. It is recommended that organizations treat this as a moderate‑to‑high risk until the vendor provides an official purge or mitigation guidance.