An incorrect authorization check in the File Access Fix (deprecated) module allows attackers to perform a forceful browsing attack, enabling them to retrieve files that should be protected. This flaw is classified as a CWE-863 vulnerability and carries a CVSS score of 5.3, indicating a moderate impact on confidentiality.

Drupal sites that have installed the File Access Fix (deprecated) module with any version from 0.0.0 through 1.1.9 are affected. The vulnerability is specific to that module within the Drupal ecosystem and therefore only those sites using it are at risk.

The moderate CVSS rating and EPSS score below 1 % suggest that exploitation is unlikely at a large scale. Because the description does not mention the need for authentication or special privileges, it is inferred that the attack can be carried out by sending crafted HTTP requests to protected file URLs from the public internet. The flaw is not listed in the CISA KEV catalog, further indicating low current exploitation activity.