Drupal Commerce Shipping contains an incorrect authorization check that permits forceful browsing. The flaw allows a user to request protected shipping content or make changes without proper authentication or authorization, exposing sensitive shipment data and enabling unauthorized modifications. The weakness corresponds to the bypass of security control category, implying potential breaches of confidentiality, integrity, and possibly availability if critical shipping logic is altered.

All releases of Drupal Commerce Shipping from 0.0.0 through 2.16.0 inclusive, and from 3.0.0 through 3.0.6 inclusive are impacted. Versions beyond 2.16.0 but below 3.0.0 and 3.0.7 or newer are not affected.

No public exploitation evidence exists and the EPSS score is not available, suggesting the current exploitation risk is unknown but potentially low. The vulnerability is not present in the CISA KEV catalog, indicating it is not commonly targeted by known threat actors currently. Attackers could exploit the flaw by issuing an HTTP request to a protected route that is missing proper authorization checks; the attack may succeed against authenticated or unauthenticated requests depending on the configuration.