A missing authorization check in the Advanced Search module permits attackers to forcefully browse search pages that should be restricted, enabling unauthorized access to search queries. The flaw relies on CWE-862, a lack of proper authorization.

The vulnerability affects the Drupal Advanced Search module in all versions from 0.0.0 up to and including 2.4.5. Administrators using these releases are at risk until an updated release that removes the authorization gap is deployed.

The vulnerability can be exercised by supplying crafted URLs to the search endpoint, and no authentication is required. The CVSS score of 4.2 indicates moderate severity, and the EPSS score of < 1% suggests a low likelihood of exploitation. The flaw relies solely on missing authorization, so any visitor can exploit it. The vulnerability is not listed in the CISA KEV catalog.