Frontend editing: This module enables editors to edit content, including paragraphs, directly on the rendered page. (CVE-2026-114541)

CVE-2026-114541 affects the Drupal Frontend editing module, which enables content editing directly on rendered pages. The module does not adequately protect the routes responsible for deleting and reordering paragraphs against CSRF attacks. This allows an attacker to craft a malicious link that, when visited by an authenticated editor with permissions to edit, delete, or move paragraphs, could cause unauthorized content manipulation. The vulnerability requires the victim to be logged in with sufficient permissions, which mitigates the risk to some extent.

An attacker can cause unauthorized deletion or reordering of paragraphs on content nodes by exploiting CSRF vulnerabilities in the Frontend editing module. The impact is limited to users with editing permissions, meaning only authenticated editors can be targeted. There is no indication of privilege escalation or broader system compromise from this vulnerability.

A patch is available for this vulnerability. Users should upgrade the Frontend editing module to version 1.9.3 or later to remediate the CSRF protection issue. Until patched, ensure that only trusted users have editing permissions and avoid clicking on suspicious links while logged in with such privileges.