This vulnerability (CVE-2026-13241) in the Drupal Paragraphs module is classified as CWE-862 (Missing Authorization). It allows unauthorized users to perform forceful browsing, potentially accessing content or functionality they should not be able to reach. The affected versions include all releases from 0.0.0 through 1.21.0. The CVSS 3.1 base score is 6.5, with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity but not availability. No vendor advisory or patch information is available, and the vulnerability is not related to a cloud service.

An attacker can exploit this missing authorization vulnerability to perform forceful browsing, potentially gaining unauthorized access to restricted content or functionality within the Drupal Paragraphs module. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Drupal security advisories for updates. Until a patch is available, consider restricting access to the Paragraphs module or implementing additional access controls as a temporary measure.