EUVD-2026-43064
GHSA-mcg9-jw6g-vx5q
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable paragraph entity routes require no authentication; limited content read/write impact only, no scope change or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
7DescriptionCVE.org
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
AnalysisAI
Forceful Browsing via missing authorization (CWE-862) in the Drupal Paragraphs contributed module allows remote unauthenticated users to access paragraph entities they are not authorized to view or modify, bypassing the CMS access control layer entirely. All Paragraphs releases from 0.0.0 up to but not including 1.21.0 are affected, per vendor advisory SA-CONTRIB-2026-060. Despite being automatable per SSVC analysis and network-exploitable with no privileges required, real-world exploitation risk is low: EPSS sits at 0.13% (3rd percentile), no public exploit code has been identified, and CISA has not added this to KEV.
Technical ContextAI
The Paragraphs module (cpe:2.3:a:drupal:paragraphs:*:*:*:*:*:*:*:*) is one of the most widely deployed Drupal contributed modules, enabling editors to construct flexible, reusable content components (paragraphs) that attach to content nodes. It introduces its own entity type with its own access control requirements. CWE-862 (Missing Authorization) indicates that one or more operations on paragraph entities - likely preview, view, or edit endpoints - omit the authorization gate entirely rather than implementing a flawed one. The Forceful Browsing technique exploits this by directly navigating to a known or guessable paragraph entity URL, which the framework serves without verifying whether the requestor has rights to that resource. This is distinct from an authentication bypass: the session layer may function normally, but the authorization layer for paragraph operations is absent.
RemediationAI
Upgrade the Drupal Paragraphs contributed module to version 1.21.0 or later, which contains the vendor-released patch as documented in Drupal security advisory SA-CONTRIB-2026-060 (https://www.drupal.org/sa-contrib-2026-060). This is the primary and recommended fix. If an immediate upgrade is not possible, a compensating control is to restrict direct access to paragraph entity routes at the web server or reverse proxy layer - for example, blocking URL patterns corresponding to paragraph entity canonical and preview paths (typically /paragraph/{id}) for unauthenticated requests via nginx or Apache access rules. This limits the Forceful Browsing surface but may break legitimate editorial preview workflows, so test before applying in production. Drupal's permissions system can also be hardened by auditing the 'access content' and custom paragraph view permissions for anonymous and authenticated roles to reduce exposure while a patch window is scheduled.
More in Paragraphs
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today