CVE-2026-126726: Composer/drupal/paragraphs_edit vulnerability

Q: Who can exploit this issue?

Any authenticated site account may be able to exploit it; no special permission is required. The attacker must also know or successfully guess a Paragraph ID.

Q: Which actions may be performed without sufficient access checks?

The affected routes are the Paragraph edit and delete routes. The module also provides clone links, but the provided information identifies insufficient access checks specifically for edit and delete.

Published Nov 11, 2026

Updated

Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragraphs.

The module doesn't sufficiently check access on the edit and delete routes for a paragraph.

This vulnerability is mitigated by the fact that an attacker must have an account on the site and must know or guess the ID of the paragraph. No special permission is required.

Affected Software

1 affected componentFixes available

composer/drupal/paragraphs_edit<3.0.2

3.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/paragraphs_edit to a version that resolves this vulnerability.
Fixed in 3.0.2

Event History

Nov 11, 2026

Advisory Published

via OSV·05:39 PM

Data Sourced

via OSV·05:39 PM

DescriptionAffected Software

Frequently Asked Questions

Who can exploit this issue?

Any authenticated site account may be able to exploit it; no special permission is required. The attacker must also know or successfully guess a Paragraph ID.

Which actions may be performed without sufficient access checks?

The affected routes are the Paragraph edit and delete routes. The module also provides clone links, but the provided information identifies insufficient access checks specifically for edit and delete.