A missing authorization issue allows forceful browsing. The module fails to sufficiently verify access to image style derivatives when these files are served through a file stream other than `private://`. This issue is mitigated if Drupal is configured to use a contributed file scheme to serve private derived images.