EUVD-2026-43065
GHSA-83x2-c529-vx4j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint, no credentials or interaction needed; C:L/I:L reflects partial paragraph content read/write without full site compromise; no availability impact identified.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
7DescriptionCVE.org
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
AnalysisAI
Missing authorization in the Drupal Paragraphs contributed module (all versions through 1.20.x) enables unauthenticated remote attackers to perform forceful browsing - directly accessing paragraph entity URLs or endpoints without passing any authorization check. The CVSS vector (PR:N/AC:L/AV:N) confirms exploitation requires no credentials against default-configured Drupal sites running the affected module. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required at the network or authentication layer - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote exploitation against any Drupal site running Paragraphs versions 0.0.0 through 1.20.x. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 base score with AV:N/AC:L/PR:N/UI:N reflects a straightforward, unauthenticated, remotely exploitable missing-authorization flaw - a real and legitimate concern. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker enumerates paragraph entity IDs or paths on a target Drupal site using sequential integer IDs or knowledge of Drupal's internal URL structure (e.g., /paragraph/{id}), then submits direct HTTP GET or POST requests to those paths. Because no authorization check is performed, the server returns or processes the paragraph content regardless of the requester's identity or role. … |
| Remediation | Update the Drupal Paragraphs module to version 1.21.0 or later, the vendor-released patch documented in Drupal SA-contrib-2026-061 at https://www.drupal.org/sa-contrib-2026-061. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Paragraphs
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today