An incorrect authorization check in the Drupal Mermaid Diagram Field module allows attackers to bypass access restrictions. The flaw permits forceful browsing, enabling an unauthorized user to view or download diagram data that should be protected. The vulnerability is classified as CWE‑863, indicating an indirect authorization bypass through parameter manipulation or misconfigured access controls.

The issue affects the Mermaid Diagram Field module used within Drupal sites. Versions from 1.0.4 up to and including 1.0.9 are vulnerable. Site administrators should verify the installed module version and determine whether their deployment includes any of the affected releases. If the module is not installed or is newer than 1.0.9, the vulnerability does not apply.

The CVSS score of 3.5 indicates a low severity. The EPSS score is less than 1%, indicating a very low exploitation probability. The vulnerability has not been listed in the CISA KEV catalog, so concrete exploitation risk data are unavailable. However, because the flaw enables direct resource access via the web interface, a remote attacker with knowledge of the module’s URLs could exploit the issue without authentication. The absence of a public fix means the risk remains high until the module is updated or restricted. Administrators should treat this as a critical patch to prevent potential exposure of private diagram data.