The Drupal Acquia DAM module contains a missing authorization flaw that permits unauthenticated attackers to access restricted resources via forceful browsing.

The vulnerability originates from a failure to perform adequate authorization checks (CWE-862). This allows an unauthenticated remote attacker to bypass access controls and perform forceful browsing to view sensitive information.

The ability for an unauthenticated user to perform forceful browsing poses a significant risk to data confidentiality. Attackers could potentially access sensitive digital assets managed within the Acquia DAM platform, leading to unauthorized data exposure and potential compliance violations. Given the CVSS score of 7.5, this vulnerability is classified as High severity due to the ease of exploitation and the potential for unauthorized information disclosure.

Immediate Action: Update the Drupal Acquia DAM module to version 1.1.5 or later to resolve the authorization failure.

Proactive Monitoring: Review web server and application access logs for unusual patterns of directory traversal or unauthorized requests to DAM assets.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter and block suspicious requests targeting the DAM module endpoints until the update is applied.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to the integrity and confidentiality of your DAM assets. Organizations should prioritize the update to version 1.1.5 immediately to close the authorization gap. Failure to patch allows attackers to bypass security controls and access protected content without any prior authentication requirements.