Drupal Commerce Shipping contains an incorrect authorization check that enables forceful browsing. An attacker who can guess or enumerate valid URLs can access or modify resources that should be protected, potentially exposing sensitive data or altering shipping settings. This weakness is classified as a direct Authorization bypass (CWE‑863).

The vulnerability impacts Drupal Commerce Shipping versions from 0.0.0 through 2.16.0 and from 3.0.0 through 3.0.6. Systems running any of these releases are susceptible until a patch is applied.

No explicit CVSS score is reported, and the EPSS score is not available, so the quantified severity is unknown. The vulnerability is listed as not included in the CISA KEV catalog. The likely attack vector is forceful browsing, which typically requires remote access to the web application; an attacker may discover valid endpoints through URL enumeration or fuzzing. Because the flaw bypasses authorization controls, successful exploitation can lead to significant confidentiality, integrity, or availability impact.