draw.io CVE-2026-42195

Exploitation requires the victim to have access to a draw.io instance with GitLab OAuth sign-in available AND to actively click the 'Authorize in GitLab' dialog after following a crafted link containing the ?gitlab= parameter. No non-default configuration is required beyond the GitLab OAuth integration being present. Exploitation is limited by: required user interaction (UI:R - the victim must click through the authorization dialog), high attack complexity (AC:H - a convincing phishing pretext is necessary to make the victim follow the crafted URL in an OAuth sign-in context), and the attack only yields value if the victim proceeds to enter credentials or approve the OAuth flow on the attacker-controlled popup. Automated or mass exploitation is not viable given these prerequisites, as confirmed by SSVC 'Automatable: no.'

The provided CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N yields a Low score of 3.4, which is broadly consistent with real-world risk signals. The high attack complexity (AC:H) reflects the social engineering prerequisite - the attacker must convince a target to follow a crafted link while intending to sign in via GitLab. EPSS at 0.03% (8th percentile) and SSVC 'Exploitation: none, Automatable: no' both confirm no observed mass exploitation. The scope change (S:C) acknowledges that the confidentiality impact crosses into the OAuth/GitLab session context, a reasonable reflection of token exfiltration risk. Critically, the numeric CVSS score of 3.4 may understate targeted-attack risk: stolen OAuth tokens or credentials can enable full GitLab account takeover regardless of the low CVSS. The 'no public exploit identified' status and 'Automatable: no' designation limit concern for now, but the attack surface - shareable diagram URLs with embedded parameters - is inherently suited to spear-phishing campaigns. No conflict exists between data sources on exploitation status.

An attacker crafts a draw.io sharing URL such as https://app.diagrams.net/?gitlab=https://phishing.attacker.example.com#diagram-id and delivers it to a targeted draw.io user via email or chat. When the victim opens the link and clicks 'Authorize in GitLab,' the OAuth popup opens on the attacker's phishing host instead of gitlab.com, where a convincing GitLab login page captures the user's credentials or intercepts the OAuth state token. No public proof-of-concept has been identified, but the attack requires only standard URL crafting and social delivery.