The vulnerability is an incorrect authorization flaw in the Drupal Quick Tabs module that allows an attacker to perform forceful browsing. By requesting URLs that should be protected, an unauthenticated or insufficiently privileged user can view tab content that should be restricted. This creates a confidentiality risk in which sensitive information accessible only to certain roles may be exposed to all users. The issue is classified as moderately critical in the advisories, reflecting the possibility of widespread access if the module is widely deployed.

Drupal sites that have the Quick Tabs module installed, specifically any deployed version from 0.0.0 through 4.3.1. Administrators should review the modules and version numbers in use and compare them to this affected range.

The CVSS score is 5.3, indicating moderate severity; no EPSS value is available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be a direct HTTP request to a Quick Tabs URL that bypasses normal authorization checks. Because the flaw stems from an incorrect permission check, an attacker who can craft or guess the tab endpoint can gain unauthorized read access. The impact is limited to data exposure rather than code execution or system compromise, yet it can be significant if sensitive tab data is involved. The lack of publicly reported exploitation does not eliminate risk; deployment of the module remains a potential attack surface until the flaw is corrected.