An improper authorization vulnerability in the /admin/elements endpoint allows unauthenticated users to access element content belonging to restricted or draft pages by supplying a valid page_version_id. The endpoint performs no authentication, authorization, or page-state checks, allowing attackers to retrieve non-public CMS content without a session. Because page_version_id values may be enumerable, the vulnerability could potentially be used to mass-enumerate and harvest restricted page content across an affected instance.