Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. (CVE-2026-96384)

CVE-2026-96384 describes an incorrect authorization vulnerability in the Drupal Mermaid Diagram Field module, specifically affecting versions from 1.0.4 up to and including 1.0.9. The issue allows forceful browsing, meaning that users with some level of privilege might bypass intended access controls to view resources they should not be able to access. The vulnerability is classified under CWE-863 (Incorrect Authorization). The CVSS v3.1 base score is 3.5, indicating low severity, with network attack vector, low attack complexity, requiring privileges, and user interaction. Confidentiality impact is low, with no integrity or availability impact.

The vulnerability allows users with some privileges to perform forceful browsing, potentially exposing information they are not authorized to access. The impact is limited to confidentiality with no reported impact on integrity or availability. Given the low CVSS score and absence of known exploits in the wild, the risk is considered low.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected module and monitor for unusual access patterns related to forceful browsing attempts.