Drupal Paragraphs CVE-2026-13240

The target site must have the Drupal Paragraphs contributed module installed, enabled, and running a version below 1.21.0. No authentication is required - the CVSS PR:N vector and 'Authentication Bypass' tag confirm unauthenticated exploitation is possible. Exploitation is bounded to paragraph entity operations only: an attacker cannot leverage this flaw to escalate to Drupal admin, execute code, or access non-paragraph content unless paragraph entities themselves contain sensitive data. Sites where all paragraph content is already publicly accessible (e.g., fully public marketing sites) have no meaningful marginal exposure. The greatest risk applies to sites that store restricted, unpublished, or role-gated content in paragraph entities.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) scores 6.5 Medium and reflects the worst-case scenario: a remote unauthenticated attacker with no interaction required. The SSVC assessment corroborates automatable exploitation with partial technical impact, but also reports Exploitation: none, indicating no observed exploitation activity. EPSS at 0.13% (3rd percentile) strongly reinforces the low probability of near-term opportunistic exploitation. The absence of a KEV listing and the lack of any reported POC further reduce urgency. The primary real-world risk is unauthorized read or modification of paragraph entity content in Drupal sites - a meaningful confidentiality and integrity concern for sites hosting sensitive structured content, but not a code execution or privilege escalation path. Priority should be moderate: patch promptly in production, but this is not an emergency requiring out-of-cycle response. Sites where paragraph content is publicly accessible already may have near-zero marginal risk.

An attacker enumerates paragraph entity IDs on a target Drupal site (IDs are typically sequential integers) by sending HTTP GET requests to /paragraph/{id} or equivalent paragraph entity routes. Because the authorization check is absent in affected versions, the server returns the paragraph content regardless of the requester's session state or role. The attacker extracts restricted editorial content - such as unpublished draft paragraphs, internal communications, or embargoed material - without any credentials.