Drupal Digital Signage Framework suffers from a missing authorization flaw that allows forceful browsing of protected configuration endpoints. Because the system does not enforce proper permissions on these sensitive pages, an attacker who can reach them—whether authenticated with minimal privileges or unauthenticated—can request and retrieve configuration data that should be restricted. The weakness, cataloged as CWE-862, enables unauthorized disclosure of potentially confidential layout or content settings, compromising the integrity of the signage delivery pipeline.

The vulnerability affects all releases of the Digital Signage Framework from 0.0.0 through 2.6.1, as reported by the vendor’s security advisory. It applies to installations of the module within Drupal deployments that have not been updated beyond version 2.6.1.

The EPSS score is not provided, and the vulnerability is not currently listed in the CISA KEV catalog, which suggests that publicly known exploitation has not been observed. However, the flaw allows an attacker who can reach the affected endpoints to perform forceful browsing, a low-barrier privilege escalation that can be leveraged to expose configuration data. Without enforced authentication checks in place, the attack vector is likely HTTP or HTTPS requests to protected URIs, which can be executed from outside the trusted network if the endpoints are publicly accessible. The CVSS score of 5.3 indicates a moderate risk; while the exploit is straightforward, the potential exposure of sensitive configuration data may impact business operations.