This vulnerability arises from incorrect authorization checks in Drupal's Webform module, enabling forceful browsing. The flaw allows an attacker to request arbitrary webform content or configuration without having the necessary permissions. This unauthorized access can expose sensitive user data or internal configuration, undermining confidentiality and potentially compromising application integrity. The weakness is identified as CWE‑863.

The issue affects all Drupal Webform versions from 0.0.0 through 6.2.12, and the 6.3.0 and 6.3.1 releases.

The CVSS score is 4.3, and the EPSS score is less than 1%, indicating a moderate severity and a low probability of exploitation, but still allowing a quantitative risk assessment. The vulnerability can be exploited remotely over the Webform interface; an attacker need only craft a URL or form request targeted at the protected resources. Since the flaw permits forceful browsing, the attack does not require authentication, making the threat vector high for publicly reachable sites. The vulnerability is not listed in the CISA KEV catalog.