This vulnerability in Drupal Commerce Realex / Global Payments involves incorrect authorization controls, specifically CWE-863, which enables unauthorized users to perform forceful browsing. This means an attacker could potentially access resources or functionality without proper permission checks. The affected versions range from 0.0.0 to 3.0.2. The CVSS 3.1 base score is 4.8, indicating a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts.

The vulnerability allows unauthorized users to bypass authorization controls and access restricted resources or functionality within the affected Drupal Commerce Realex / Global Payments module. The impact is limited to confidentiality and integrity, with no availability impact reported. There are no known active exploits in the wild.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should monitor official Drupal security advisories for updates and consider restricting access to affected components where possible.