The vulnerability in the Drupal Ultimate Table Field module is a missing authorization flaw that permits forceful browsing. An attacker can access restricted user content or configuration pages that should be protected, potentially exposing sensitive data. The weakness corresponds to CWE-862, which denotes an attempt to bypass access controls.

Drupal users employing the Ultimate Table Field module are affected when their installations run any version from 0.0.0 through 1.1.1 or from 2.0.0 through 2.0.1. The module is listed under the Drupal vendor and is commonly used to display tabular data within sites.

Because the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the objective likelihood of exploitation is low, though the absence of a KEV listing does not imply the flaw is not actively used. The CVSS score is 4.3, indicating a moderate impact. The exploit path is straightforward: an attacker can request the protected URLs normally guarded by authentication checks, thereby bypassing access controls. The default configuration often allows anonymous or insufficiently restricted roles to reach these pages, enabling an attacker to retrieve or manipulate data.