The vulnerability is an incorrect authorization flaw that permits forceful browsing of protected resources in Drupal Commerce Core. By manipulating URLs or requests, an unauthenticated user can access content or administrative interfaces that should be restricted, allowing potential data exposure and configuration changes.

Drupal Commerce Core versions from 0.0.0 to 2.41.0 and from 3.0.0 through 3.3.13 are impacted. Users running these ranges on any Drupal site should assess whether the Commerce Core module is installed.

Based on the description, the likely attack vector is remote over HTTP forceful browsing and can be performed without authentication if an attacker can guess a valid URL. The absence of an EPSS score and lack of KEV listing suggest no publicly known exploitation, but the weakness in access control remains significant, posing a high risk to confidentiality and integrity for e‑commerce sites.