An authorization flaw allows forceful browsing via a route used to display published content entities in a dialog. The system fails to sufficiently verify if the current user has access to the specific entity being requested. This issue is partially mitigated as field-level access controls remain active and only rendered output is returned.