Executive brief
The Mermaid Diagram Field module for Drupal allows content managers to embed diagram visualizations in content entities. A flaw in the module fails to properly enforce access controls on modal-displayed diagrams and does not respect Drupal's revision access rules, potentially exposing diagram content to unauthorized users who know the modal route and entity ID.
Technical details
The module lacks proper access control enforcement for modal content display and does not adequately respect default revision behavior, allowing unauthorized access to diagram content. The vulnerability requires either the modal display option to be enabled for the field or knowledge of the specific modal route and entity ID. A fix was released in version 1.0.10.
Affected products
- Drupal Mermaid Diagram Field 1.0.4 to 1.0.9
Timeline
- 2026-09-23: disclosed
- 2026-09-23: patched: Version 1.0.10 released