EUVD-2026-43065
GHSA-83x2-c529-vx4j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-reachable endpoint, no credentials or interaction needed; C:L/I:L reflects partial paragraph content read/write without full site compromise; no availability impact identified.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
7DescriptionCVE.org
Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.
AnalysisAI
Missing authorization in the Drupal Paragraphs contributed module (all versions through 1.20.x) enables unauthenticated remote attackers to perform forceful browsing - directly accessing paragraph entity URLs or endpoints without passing any authorization check. The CVSS vector (PR:N/AC:L/AV:N) confirms exploitation requires no credentials against default-configured Drupal sites running the affected module. Despite an automatable attack surface, SSVC rates exploitation as none, EPSS sits at 0.13% (3rd percentile), and no active exploitation is confirmed; a vendor patch is available via Drupal SA-contrib-2026-061.
Technical ContextAI
Drupal Paragraphs (CPE: cpe:2.3:a:drupal:paragraphs) is a widely-used contributed module enabling component-based, structured content authoring on Drupal CMS installations. The root cause is CWE-862 (Missing Authorization): the module fails to enforce access control on one or more paragraph entity endpoints or URL paths, permitting direct object reference access - a class of flaw known as Forceful Browsing - where an attacker navigates directly to a resource URL the application never intended to expose without checking whether the requestor holds the required permission. Because the flaw sits in the HTTP request-handling layer (AV:N, AC:L), it requires no special network position or protocol manipulation. The S:U scope indicates the unauthorized access is bounded within the Drupal application context and does not cross a security boundary to affect other systems.
RemediationAI
Update the Drupal Paragraphs module to version 1.21.0 or later, the vendor-released patch documented in Drupal SA-contrib-2026-061 at https://www.drupal.org/sa-contrib-2026-061. If immediate patching is not possible, restrict anonymous and low-privileged user roles to the minimum necessary permissions in Drupal's People > Permissions configuration, which reduces the surface for unauthorized paragraph content access. Enforcing WAF or web server access controls on Drupal's entity and JSON:API paths for unauthenticated requests is an additional compensating control, though this may interfere with public content rendering that legitimately serves paragraph data. Disabling the Paragraphs module entirely eliminates exposure but will break any content that relies on paragraph fields. The vendor-released patch at version 1.21.0 is the definitive fix; no specific fix version beyond 1.21.0 is needed.
More in Paragraphs
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today