Live › vulnerability › CVE-2026-96384
Go to dashboardThe Drupal Mermaid Diagram Field module has an incorrect authorization check that lets a user reach content by directly requesting its URL. The sources do not say what content is exposed or how much an attacker gets from it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Drupal with the Mermaid Diagram Field module in versions through . The sources do not say which content or configuration is needed for exposure, so the exact exposure is unknown.
1.0.41.0.9No product ranges from the sources yet.
drush pm:list --filter=mermaid or in composer.lock for drupal/mermaid_diagram_field1.0.9, the last affected version listed in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing. This issue affects Mermaid Diagram Field versions: from 1.0.4 to 1.0.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-96384")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.