"Ricochet has proven to be a partner that we can depend on to create and maintain a successful drupal-based CMS system. Their deep experience in drupal has allowed them to identify existing plugins and to quickly implement custom logic when required to efficiently implement our international content management workflow and site. Ricochet has shown their commitment to our success again and again, working collaboratively across our team to make it happen, and putting in the extra effort when needed to meet our business goals."
—David Saffren, Blurb.com

Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061

Wed, 2026-06-24 11:43 — Anonymous (not verified)

Project: ParagraphsDate: 2026-June-24Security risk: Moderately critical 11 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassAffected versions: <1.21.0CVE IDs: CVE-2026-13241Description: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use and general write access to paragraphs through another module must be allowed.Solution: Install the latest version:

If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.21

Reported By:

Mustafa Ahmed (mustafa007)

Fixed By:

Sascha Grossenbacher (berdir)

Coordinated By:

Greg Knaddison (greggles) of the Drupal Security Team
Juraj Nemec (poker10) of the Drupal Security Team

Path to article https://www.drupal.org/sa-contrib-2026-061

Search form

Paragraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-061