Mermaid Diagram Field EUVD-2026-107821

Exploitation requires an installed Drupal site running the Mermaid Diagram Field contrib module at a version between 1.0.4 and 1.0.9, and an attacker who already holds a valid low-privileged account on that site (PR:L). The flaw is an access-control gap allowing such an authenticated user to forcefully browse to Mermaid diagram field content they should not be permitted to see. Limiting factors: authentication is required (not anonymous/remote-unauthenticated), the CVSS vector models required user interaction (UI:R), impact is confined to limited confidentiality disclosure of diagram content (I:N/A:N), and the precise configuration or URL pattern that triggers the bypass is not detailed in the available advisory text.

All available signals point to a low real-world priority. The CVSS 3.1 base score is only 3.5 (LOW), and the vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) indicates that while the issue is network-reachable with low complexity, it requires an already-authenticated low-privileged account (PR:L) plus user interaction (UI:R), and the only impact is a limited confidentiality exposure (C:L) with no integrity or availability effect. EPSS reinforces this: 0.18% probability at the 7th percentile is very low, and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. The vuln.today Decision label is 'monitor', consistent with the low severity and low EPSS. No SSVC fields (automatable, technical impact) were supplied in the input, so that framework cannot be cross-referenced. The signals are therefore internally consistent - a genuine but minor authorization weakness, not a high-CVSS-but-low-risk anomaly and not an urgent threat. One caveat: the 'Authentication Bypass' tag overstates the issue, which is actually incorrect authorization (CWE-863) / forceful browsing, i.e. an authenticated user reaching content they should not, not a bypass of authentication itself.

A low-privileged authenticated Drupal user navigates directly to a Mermaid Diagram Field resource URL that they are not authorized to view, and the module fails to enforce access control (forceful browsing), disclosing the diagram content. No public exploit code was identified in the input; the only references are the Drupal security advisory and the NVD entry. The CVSS vector's AC:L and UI:R indicate the action is simple but is modeled as involving some user interaction; the exact trigger is not described in the available sources.