An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify user permissions when creating specific media types if the bulk upload form is configured for those types. Exploitation requires the attacker to possess a role with the "bulk upload form" permission.