The vulnerability in Drupal Commerce Core allows attackers to forcefully browse sensitive data through improper handling of data queries. An unauthenticated user could construct requests that reveal protected information, potentially exposing customer details or private operational data. The flaw is a classic information disclosure weakness that can compromise confidentiality without altering system integrity or availability.

Drupal Commerce Core products are affected. Versions from 0.0.0 through 2.41.0 and from 3.0.0 through 3.3.13 are vulnerable. These encompass both early development builds and stable releases within that range. Users running any of these versions should verify the install and consider remediation.

The exploit path requires basic web access to the Commerce Core instance and the ability to manipulate query parameters. There is no indication of remote code execution or privileged escalation; the risk is purely data exposure. The EPSS score is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited documented exploitation. However, the moderate severity indicates a non‑trivial threat to confidentiality that warrants attention.