The Drupal SAML SSO – Service Provider module suffers from a missing authorization check, allowing an attacker to forcefully traverse protected URLs. The absence of access control can enable the attacker to view or modify restricted content, leading to unauthorized data disclosure. This weakness aligns with the CWE-862 designation for Missing Authorization.

Drupal users running the SAML SSO – Service Provider module from version 0.0.0 through 3.2.0 are impacted. The vulnerability affects all installations of this module within that version range, regardless of the Drupal core version.

From the available data, the vulnerability has a CVSS score of 6.5, indicating a moderate severity. It is not listed in the CISA KEV catalog and the EPSS score is below 1%, suggesting limited publicly known exploitation. The most probable attack vector is remote over the network, where an unauthenticated actor can access protected endpoints to forcefully browse content. The moderate severity of the authorization flaw still makes remediation a priority for affected organizations.