The vulnerability is a missing authorization check in Drupal Islandora that allows attackers to perform forceful browsing by requesting URLs that should be protected. By accessing these URLs, an unauthenticated user can view restricted content, potentially exposing confidential data. The weakness is classified as CWE-862, which denotes missing authorization.

Drupal Islandora versions from 0.0.0 to 2.19.0 are affected. All releases within that range are vulnerable, meaning any installation that has not been upgraded beyond version 2.19.0 is at risk.

The flaw permits unauthorized access without authentication. The CVSS score of 3.7 indicates moderate severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in CISA KEV, so it is not a known widespread exploit. Missing authorization vulnerabilities are typically high risk for confidentiality. Attackers can exploit it by sending crafted HTTP or HTTPS requests to protected endpoints; no special privileges are required beyond network reach to the target. The likely attack vector is remote HTTP or HTTPS access via direct URL manipulation.