File Access Fix Deprecated EUVD-2026-16377

Real-world risk is moderate to high despite missing CVSS and EPSS scores. The attack vector is network-based and requires no authentication (CWE-863 indicates authorization bypass, not credential compromise), making it exploitable by unauthenticated remote attackers with minimal technical skill. The lack of CVSS vector data prevents formal severity quantification, but the combination of unauthenticated remote exploitability and file confidentiality impact suggests CVSS v3.1 impact would be at least Medium-to-High. The deprecated status of the module is a critical risk signal: deprecated software typically receives no security patches, and administrators may have forgotten they have it installed. No KEV status or public POC has been identified, indicating this may be a low-visibility vulnerability in an older/less-maintained module; however, absence of known exploitation does not reduce risk if the module remains deployed in production Drupal sites. SSVC framing: exploitation is likely possible (trivial-HTTP GET request), likely automatable (path enumeration), and causes direct confidentiality breach of file contents. Organizations should prioritize patching or removal based on deployment inventory.

An unauthenticated attacker discovers or enumerates the path to a protected file (e.g., /sites/default/files/private/sensitive-document.pdf) by iterating through common naming patterns or leaked URLs. The attacker sends a direct HTTP GET request to that path. Because File Access Fix (deprecated) fails to validate the attacker's authorization before serving the file, the web server returns the file content directly. The attacker gains unauthorized access to confidential data-such as private user uploads, financial records, or internal documents-without providing any credentials or bypassing authentication; they simply requested the resource and the inadequate authorization check permitted the download.