DRUPAL-CONTRIB-2026-317: Composer/drupal/paragraphs_edit vulnerability
Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragraphs.
The module doesn't sufficiently check access on the edit and delete routes for a paragraph.
This vulnerability is mitigated by the fact that an attacker must have an account on the site and must know or guess the ID of the paragraph. No special permission is required.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/paragraphs_editto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated site user may be able to exploit it; no special permission is required. The attacker must know or guess the ID of a target paragraph.
Which actions may be performed without sufficient access checks?
The affected routes are the Paragraphs Edit module's edit and delete routes for individual Paragraphs. The module adds contextual edit, clone, and delete links, but the reported insufficient access checks apply to edit and delete.
Are anonymous visitors affected?
The issue is mitigated by the requirement for an attacker to have an account on the site. The provided information does not indicate that anonymous visitors can exploit it.