SA-CONTRIB-2026-241: Critical severity drupal/frontend_editing vulnerability

Q: Which users could exploit this issue?

A user must have the "access frontend editing" permission, the relevant paragraph permission ("add paragraphs", "edit paragraphs", or "delete paragraphs"), and permission to update the parent entity containing the affected field.

Q: Are users without permission to update the parent entity affected?

No. Exploitation requires access to update the parent entity to which the entity reference revisions field belongs.

Q: What access-control area should administrators review while triaging this issue?

Review roles granted frontend editing and paragraph add, edit, or delete permissions, together with their ability to update parent entities that contain entity reference revisions fields.

Published Oct 21, 2026

Updated

This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to.

Credit

Artem Dmitriiev (a.dmitriiev)

Affected Software

1 affected componentFixes available

drupal/frontend_editing<1.9.3

1.9.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade drupal/frontend_editing to a version that resolves this vulnerability.
Fixed in 1.9.3
Configuration
Restrict these permissions to trusted roles to prevent unauthorized users from editing, adding, or deleting paragraph items in entity reference revisions fields.
access frontend editing, add paragraphs, edit paragraphs, delete paragraphs, and permission to update the parent entity = restricted to trusted roles only

Event History

Oct 21, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114553

Frequently Asked Questions

Which users could exploit this issue?

A user must have the "access frontend editing" permission, the relevant paragraph permission ("add paragraphs", "edit paragraphs", or "delete paragraphs"), and permission to update the parent entity containing the affected field.

Are users without permission to update the parent entity affected?

No. Exploitation requires access to update the parent entity to which the entity reference revisions field belongs.

What access-control area should administrators review while triaging this issue?

Review roles granted frontend editing and paragraph add, edit, or delete permissions, together with their ability to update parent entities that contain entity reference revisions fields.

SA-CONTRIB-2026-241: Critical severity drupal/frontend_editing vulnerability

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which users could exploit this issue?

Are users without permission to update the parent entity affected?

What access-control area should administrators review while triaging this issue?

Company

Resources

Contact

Frequently Asked Questions

Which users could exploit this issue?

Are users without permission to update the parent entity affected?

What access-control area should administrators review while triaging this issue?