The vulnerability is an incorrect authorization check in the Advanced Content Feedback module of Drupal, enabling forceful browsing of content. An attacker can programmatically request feedback objects that they are not permitted to view, allowing exposure of potentially sensitive information. The flaw is formally classified as an Insecure Direct Object Reference (CWE‑863).

The vulnerability affects the Drupal Advanced Content Feedback (aka admin_feedback) module. Versions 0.0.0 through 2.8.0 are affected. Any site that has installed this module within those releases is potentially vulnerable until it is updated beyond 2.8.0.

Because the exploit requires only an HTTP request to an existing feedback object, the threat vector is likely remote through the web interface. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, meaning no mass‑production exploits are known. Nevertheless, the lack of a proper authorization check means that any authenticated or unauthenticated user who can determine a valid object identifier could access data they should not. The CVSS score is 3.1, and based on the description it is inferred that the confidentiality impact could be substantial on a pod or shared hosting environment.