The vulnerability is a missing authorization flaw that allows forceful browsing of the Drupal Calculate Working Days module. An attacker can access configuration details, API endpoints, or other protected resources without proper authentication. This can lead to unintended data disclosure and potential manipulation of working‑day calculations. The weakness falls under Missing Authorization, which poses a direct risk to confidentiality and integrity of data that should be restricted.

Drupal: Calculate Working Days is affected from version 0.0.0 through 2.0.3. All installations within this range are susceptible to the forceful browsing capability enabled by the missing access controls.

Because the flaw permits direct HTTP requests to protected URLs, the attack can be performed remotely by anyone with network access to the Drupal site. The exploit requires no special privileges beyond network connectivity; it does not rely on code execution or privilege escalation. The CVSS score of 5.3 indicates a medium severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploitation at this time. Nonetheless, the ability to bypass authorization elevates the risk of data exposure, warranting timely remediation.