The vulnerability in Drupal Jsonapi Role Access is an incorrect authorization flaw that permits forceful browsing of protected resources. An attacker who can locate an API path may retrieve data that should be restricted, compromising confidentiality. The weakness is classified as CWE-863, which indicates an access control failure where users can obtain data beyond their authorization level.

Drupal Jsonapi Role Access modules with any version starting from 0.0.0 up to and including 2.0.2 are affected. Installations that rely on these modules for managing role‑based access to JSON API endpoints are therefore vulnerable.

The CVSS score of 6.5 indicates medium severity; the EPSS score is less than 1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The most likely attack vector is remote, via HTTP requests made to the exposed API endpoints, and does not require privileged local access. Because the flaw allows direct read access to restricted data, the impact is significant for sites that expose sensitive content through the Jsonapi Role Access module. The low EPSS score indicates that widespread exploitation is unlikely, but the fundamental access bypass makes it a high‑priority concern for any production deployment.