Drupal File Download Missing Authorization Vulnerability Allowing Forceful Browsing

A missing authorization vulnerability has been identified in the Drupal File Download module, specifically in versions prior to 1.9.0 and from 2.0.0 through 2.0.1. This vulnerability allows for forceful browsing by bypassing access controls, enabling users to access private files that should not be publicly available.

Impact

Exploitation of this vulnerability leads to unauthorized access to private files, allowing users to download files that should be restricted.

Remediation

Users are advised to upgrade to File Download version 2.0.1 or 8.x-1.9.