An incorrect authorization check in Drupal Entity API permits forceful browsing, making unauthorized users able to retrieve content they should not have access to. Because the API fails to enforce proper permission checks, attackers can navigate to arbitrary entity URLs and view sensitive data. The weakness is classified as CWE‑863, insufficient authorization, and can lead to private or confidential information being exposed without authentication or proper privilege verification.

Drupal's Entity API is affected. All installations using versions from 0.0.0 up to and including 1.8.0 are vulnerable. Versions later than 1.8.0 are not listed as affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that automated exploitation is not currently widespread or formally documented. Nonetheless, attackers can exploit this flaw by sending crafted HTTP requests to Entity API endpoints that a user normally cannot access. With the ability to forcefully browse, an attacker could potentially enumerate content and retrieve data that should be protected by the site’s access control. The risk is significant for sites that expose sensitive data via the Entity API, especially if users have limited permissions. The lack of a public exploitation record does not negate the need for remediation, as the vulnerability can be trivially leveraged once the correct URL is known.