SA-CONTRIB-2026-317: Critical severity composer/drupal/paragraphs_edit vulnerability
Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragraphs. The module doesn't sufficiently check access on the edit and delete routes for a paragraph. This vulnerability is mitigated by the fact that an attacker must have an account on the site and must know or guess the ID of the paragraph. No special permission is required.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/paragraphs_editto a version that resolves this vulnerability.Fixed in 3.0.2
Event History
Frequently Asked Questions
Can an attacker exploit this without elevated permissions?
No special permission is required, but the attacker must have an account on the site. Any authenticated account that knows or can guess a paragraph ID may be able to target the affected routes.
Is anonymous access enough to exploit the issue?
No. The available information states that an attacker must have an account on the site.
What information does an attacker need to target a paragraph?
The attacker must know or guess the ID of the paragraph they want to access through the affected edit or delete routes.