What is the CVSS score of CVE-2026-13241?

CVE-2026-13241 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13241?

Yes, a patch is available for CVE-2026-13241. Update the affected software to the latest version immediately.

Drupal Paragraphs CVE-2026-13241

EUVD-2026-43065 MEDIUM

Missing Authorization (CWE-862)

2026-07-10 drupal

GHSA-83x2-c529-vx4j

Authentication Bypass Drupal Paragraphs

6.5

CVSS 3.1 · Vendor: drupal

Severity by source

Vendor (drupal) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint, no credentials or interaction needed; C:L/I:L reflects partial paragraph content read/write without full site compromise; no availability impact identified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (drupal).

CVSS VectorVendor: drupal

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 21:19 vuln.today

Severity Changed

Jul 13, 2026 - 19:22 NVD

CRITICAL MEDIUM

CVSS changed

Jul 13, 2026 - 19:22 NVD

9.8 (CRITICAL) 6.5 (MEDIUM)

CVSS changed

Jul 13, 2026 - 19:07 NVD

9.8 (CRITICAL)

Patch available

Jul 10, 2026 - 23:02 EUVD

CVE Published

Jul 10, 2026 - 21:44 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 10, 2026 - 21:44 cve.org

MEDIUM 6.5

DescriptionCVE.org

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

AnalysisAI

Missing authorization in the Drupal Paragraphs contributed module (all versions through 1.20.x) enables unauthenticated remote attackers to perform forceful browsing - directly accessing paragraph entity URLs or endpoints without passing any authorization check. The CVSS vector (PR:N/AC:L/AV:N) confirms exploitation requires no credentials against default-configured Drupal sites running the affected module. Despite an automatable attack surface, SSVC rates exploitation as none, EPSS sits at 0.13% (3rd percentile), and no active exploitation is confirmed; a vendor patch is available via Drupal SA-contrib-2026-061.

Technical ContextAI

Drupal Paragraphs (CPE: cpe:2.3:a:drupal:paragraphs) is a widely-used contributed module enabling component-based, structured content authoring on Drupal CMS installations. The root cause is CWE-862 (Missing Authorization): the module fails to enforce access control on one or more paragraph entity endpoints or URL paths, permitting direct object reference access - a class of flaw known as Forceful Browsing - where an attacker navigates directly to a resource URL the application never intended to expose without checking whether the requestor holds the required permission. Because the flaw sits in the HTTP request-handling layer (AV:N, AC:L), it requires no special network position or protocol manipulation. The S:U scope indicates the unauthorized access is bounded within the Drupal application context and does not cross a security boundary to affect other systems.

RemediationAI

Update the Drupal Paragraphs module to version 1.21.0 or later, the vendor-released patch documented in Drupal SA-contrib-2026-061 at https://www.drupal.org/sa-contrib-2026-061. If immediate patching is not possible, restrict anonymous and low-privileged user roles to the minimum necessary permissions in Drupal's People > Permissions configuration, which reduces the surface for unauthorized paragraph content access. Enforcing WAF or web server access controls on Drupal's entity and JSON:API paths for unauthenticated requests is an additional compensating control, though this may interfere with public content rendering that legitimately serves paragraph data. Disabling the Paragraphs module entirely eliminates exposure but will break any content that relies on paragraph fields. The vendor-released patch at version 1.21.0 is the definitive fix; no specific fix version beyond 1.21.0 is needed.