CVE-2026-96384
Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- Record
CVE-2026-96384- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2026-107821
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- Record
EUVD-2026-107821- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h68g-2xqj-xfj8
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing....
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- Record
GHSA-h68g-2xqj-xfj8- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- Record
CVE-2026-96384- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
- Record
CVE-2026-96384- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVDRUPAL-CONTRIB-2026-180No score
This module enables you to add mermaid diagram that displays either inline on an entity or optionally in a modal.
The module doesn't sufficiently respect default revision behavior and does not properly limit access to the modal content.
This vulnerability is mitigated by the fact that an attacker must have the modal display option enabled for the field, or otherwise know the route of the modal and entity ID.
- Record
DRUPAL-CONTRIB-2026-180- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/mermaid_diagram_fieldPackagist:https://packages.drupal.org/8 | 1.0.4 up to 1.0.9 | 1.0.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-96384 is a low vulnerability (CVSS 3.5) in Drupal Mermaid Diagram Field, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in drupal/mermaid_diagram_field 1.0.9.