This vulnerability (CVE-2026-13240) in the Drupal Paragraphs module is classified as CWE-862 (Missing Authorization). It allows unauthorized users to perform forceful browsing, potentially accessing content or functionality without proper permission checks. The affected versions include all releases from 0.0.0 through 1.21.0. The CVSS v3.1 base score is 6.5 (medium), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability. No vendor advisory or patch information is currently available, and the vulnerability is not related to a cloud service.

An attacker can exploit this missing authorization flaw to access resources or perform actions that should be restricted, potentially leading to unauthorized disclosure and modification of data. The impact affects confidentiality and integrity but does not affect availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Drupal security advisories for updates. Implementing additional access controls or restricting access to the Paragraphs module may help reduce exposure.