The vulnerability arises from incorrect authorization checks in Drupal's Material Icons module. An attacker can forcefully browse to assets or URLs that should be restricted, exposing potentially sensitive content. This weakness maps to CWE‑863, which deals with improper authorization. The primary consequence is that users or attackers gain access to resources that should be protected, undermining confidentiality but not directly affecting system availability or integrity.

Drupal website operators using the Material Icons module are impacted. Versions starting from the initial release up to, but not including, 2.0.4 are vulnerable. If your site runs an older version of this module on Drupal, it is at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1 % suggests that the exploit probability is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers would likely exploit the flaw by manipulating URLs or requests to access the protected content, a typical forceful browsing scenario. While exploitation risk remains moderate, the potential impact on confidential material warrants prompt attention.