This vulnerability (CVE-2026-13239) in Drupal WissKI is classified as CWE-862 (Missing Authorization). It allows unauthorized users to perform forceful browsing, potentially accessing restricted content or functionality. The affected versions include all WissKI releases from 0.0.0 through 4.2.0. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, with low attack complexity and impacts confidentiality and integrity but not availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows unauthorized access to resources within the WissKI module, potentially exposing sensitive information or allowing unauthorized modification of data. The confidentiality and integrity of the system are impacted, but availability is not affected. Because the attack requires no privileges or user interaction and can be performed remotely, it poses a moderate risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WissKI module and monitor for unusual access patterns to mitigate potential exploitation.