CVE-2026-13240

MediumCVSS 6.5

Published: 10/07/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

6th percentile - higher than 6% of all known CVEs

Missing authorization in the Drupal Paragraphs module allows Forceful Browsing. This affects versions from 0.0.0 to 1.21.0.

An attacker can access protected content or functions without proper permissions, leading to data confidentiality breaches.

Update the Paragraphs module to version 1.21.1 or later.

Original NVD description (English source)

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS