The vulnerability is an improper check for unusual or exceptional conditions in Drupal Node View Permissions that allows forceful browsing. This enables an attacker to access content that would normally be restricted, violating the intended permission controls.

The affected product is the Drupal Node View Permissions module. Versions before 1.7.0 in the 0.0.0 line and before 2.0.1 in the 2.0.0 line are vulnerable. Any installation using these module releases is at risk.

The EPSS score is <1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 3.7, which reflects a low severity impact. Based on the nature of the flaw, it is inferred that an unauthenticated attacker could supply arbitrary node URLs to force traversal of permission checks, making exploitation straightforward in the absence of a patch.