Mermaid Diagram Field
Monthly
Mermaid Diagram Field 1.0.4 to 1.0.9, a contributed Drupal module, contains an access-control gap (CWE-863) that lets a user who already holds a valid low-privileged account reach Mermaid diagram field content they are not permitted to view by requesting it directly (forceful browsing). The result is limited confidentiality exposure of diagram content only - integrity and availability are unaffected - and the CVSS vector (AV:N/AC:L/PR:L/UI:R, CVSS 3.5) models both an authenticated attacker and a user-interaction component. No public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and the case is not in CISA KEV; the vuln.today decision label is monitor, consistent with a low real-world priority.
Mermaid Diagram Field 1.0.4 to 1.0.9, a contributed Drupal module, contains an access-control gap (CWE-863) that lets a user who already holds a valid low-privileged account reach Mermaid diagram field content they are not permitted to view by requesting it directly (forceful browsing). The result is limited confidentiality exposure of diagram content only - integrity and availability are unaffected - and the CVSS vector (AV:N/AC:L/PR:L/UI:R, CVSS 3.5) models both an authenticated attacker and a user-interaction component. No public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and the case is not in CISA KEV; the vuln.today decision label is monitor, consistent with a low real-world priority.