The vulnerability is an Incorrect Authorization flaw that permits forceful browsing. It allows an attacker to access content or configuration data that normal users should not see, potentially exposing sensitive business or user information. The weakness is a classic access control bypass.

The affected product is the Drupal Commerce License module. Versions from 0.0.0 through 3.1.1 are vulnerable, affecting any Drupal site that has installed the module within that range.

Because the flaw permits direct URL manipulation to view protected resources, the attack can be performed from any network that can reach the site. No authentication or privilege escalation is required to exploit the flaw; the attacker only needs to know or guess a protected path. The vulnerability has no publicly available exploit code as of today, and it is not listed in the CISA KEV catalog. Absence of an EPSS score prevents a precise probability estimate, but the potential for data exposure and the lack of mitigations suggest a moderate risk level for engaged attackers.