Greg Mack

The issue is related to insufficient authorization procedures in the Commerce View Receipt module of the Drupal CMS system. This can allow a remote attacker to bypass security restrictions and perform a forceful browsing attack.