Threats tagged 'drupal-contrib-2026-317'

The Paragraphs Edit module for Drupal versions prior to 3.0.2 has an access control vulnerability. It adds contextual edit, clone, and delete links to individual paragraphs but does not sufficiently verify access permissions on the edit and delete routes. Exploitation requires the attacker to have an account on the site and knowledge or guessing of the paragraph ID. No special permissions are needed to attempt these actions. A fix is available in version 3.0.2.