The Drupal Commerce Core component contains an incorrect Authorization flaw that permits attackers to perform forceful browsing. This flaw allows an unauthenticated user or a user without appropriate permissions to request URLs that belong to a merchant or administrator area, thereby exposing confidential merchant data and product information. The underlying weakness is a misimplementation of ACL enforcement (CWE‑863).

The vulnerability affects Drupal Commerce Core versions 0.0.0 through 2.41.0 and 3.0.0 through 3.3.13. These versions are distributed by the Drupal community and are commonly deployed in e‑commerce websites using Drupal.

As the CVSS score is not publicly disclosed, it is difficult to quantify the severity numerically. The exploitability appears low to moderate because it requires knowledge of merchant URLs. Since no public exploitation has been reported and the vulnerability is not listed in CISA KEV, the likelihood of an immediate widespread attack is low. However, the risk to merchant confidentiality remains significant for sites running the affected version stack. The attack vector is inferred to be remote over the web, leveraging the ability to request disallowed URLs.