The vulnerability is a missing authorization flaw that allows an attacker to forcefully browse content protected by the Drupal PhotoSwipe module. This authorization bypass enables unauthorized disclosure of image resources that should otherwise be restricted, potentially revealing sensitive or confidential media. The weakness is classified as CWE-862 and CWE-425, indicating that an attacker can access protected image resources and bypass authentication or authorization mechanisms without possessing the necessary permissions.

Drupal's PhotoSwipe - Responsive JavaScript Modal Image Gallery module is affected. All releases from the initial 0.0.0 version up to and including 3.2.0 are susceptible. Administrators using these versions should verify the installed module version to determine exposure.

The CVSS score is 9.1 and the EPSS score is < 1%, indicating a high severity vulnerability with a very low likelihood of exploitation. However, the module’s wide usage and the straightforward nature of forceful browsing suggest that an attacker can easily craft requests to retrieve restricted images. The vulnerability is not listed in CISA’s KEV catalog, but the lack of a known exploit does not diminish the risk of internal or public disclosure. The likely attack vector is the manipulation of URLs or parameters that trigger image retrieval without checking user permissions. An attacker with network access or the ability to interact with the site can attempt successive requests until a protected image is returned.