This vulnerability is an incorrect authorization flaw that enables forceful browsing. An attacker who does not have legitimate access can request URLs that display Webform content, exposing sensitive configuration or form data. The weakness falls under CWE‑863, which means the system does not enforce proper authentication or access control before allowing content to be viewed or modified.

Drupal Webform module versions from 0.0.0 through 6.2.12 and from 6.3.0 through 6.3.1 are affected. The issue applies to the module itself when accessed via standard Webform URLs, regardless of the role of the user attempting to retrieve the content.

The advisory lists a CVSS score of 5.3 and an EPSS score of <1%, indicating moderate severity and a very low exploitation probability. However, because the flaw allows unauthenticated users to view and potentially modify form data, the potential impact is significant for websites relying on strict confidentiality of form submissions. No known public exploits are listed in CISA KEV, but the very low EPSS score does not rule out exploitation risk, especially if sensitive form data is exposed.