The vulnerability is a missing authorization flaw that permits attackers to forcefully browse content that should be restricted. A malicious user can request URLs normally protected by the Drupal AI Translate module and receive the corresponding data, thereby exposing sensitive information and potentially compromising system integrity. The weakness is classified as Authorization Denial (CWE‑862).

Drupal AI Translate is affected. Versions from 0.0.0 through 1.3.2, and again from 1.4.0 through 1.4.1, lack required access controls.

Because the flaw does not require elevated credentials and can be triggered via standard HTTP requests, the attack vector is likely through the public web interface. The EPSS score is <1% and the CVSS score is 4.6, categorizing it as moderate severity. The vulnerability is not listed in the CISA KEV catalog, but its moderate CVSS indicates that exploitation could have a noticeable impact on confidentiality and availability for affected installations.