Dezså Biczã³

A missing authorization issue allows forceful browsing. Certain Drupal core actions exposed as agent tools lack correct access validation, and some core actions are missing associated access-level definitions. This allows an agent to utilize Drupal core actions tools by bypassing access controls, provided the attacker can communicate with the affected agent and the site is configured to expose these tools to non-privileged users.

The issue is related to the insertion of sensitive information into sent data, which allows for forceful browsing. This can be exploited by a remote attacker to bypass security restrictions.