Drupal Paragraphs CVE-2026-13241

No special conditions are required at the network or authentication layer - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against any Drupal site running Paragraphs versions 0.0.0 through 1.20.x. The limiting factor is attacker knowledge of valid paragraph entity IDs or URL paths, which constrains exploitation to discovery-capable attackers (enumerable sequential IDs are common in Drupal). Impact is bounded to the paragraph content layer (C:L/I:L): attackers can read or potentially modify paragraph content items without authorization but cannot escalate to full administrative control based on available data. The Paragraphs module must be installed and active; Drupal sites that do not use the Paragraphs module are not affected.

The CVSS 6.5 base score with AV:N/AC:L/PR:N/UI:N reflects a straightforward, unauthenticated, remotely exploitable missing-authorization flaw - a real and legitimate concern. However, multiple converging signals cap the actual urgency: EPSS at 0.13% (3rd percentile) indicates very low observed exploitation probability across the threat landscape, SSVC classifies exploitation status as none, and no CISA KEV listing or public proof-of-concept code has been identified. The SSVC automatable:yes rating is the primary escalating signal - if mass-exploitation interest emerged, scripted scanning and exploitation would be trivial, raising exposure for all unpatched sites simultaneously. Impact is bounded by C:L/I:L/A:N, meaning attackers may read or modify paragraph content they are not authorized to access but cannot achieve full site compromise based on available data. Overall assessment: a genuine vulnerability warranting scheduled patching within normal maintenance cycles, but not emergency response, for most organizations absent evidence of active exploitation.

An unauthenticated attacker enumerates paragraph entity IDs or paths on a target Drupal site using sequential integer IDs or knowledge of Drupal's internal URL structure (e.g., /paragraph/{id}), then submits direct HTTP GET or POST requests to those paths. Because no authorization check is performed, the server returns or processes the paragraph content regardless of the requester's identity or role. No public proof-of-concept code has been identified, but the low complexity and automatable nature of the attack means it could be scripted across large numbers of Drupal sites simultaneously.