DRUPAL-CONTRIB-2026-061unknown
DRUPAL-CONTRIB-2026-061
The advisory, in context
The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to direct child paragraphs of library items through API endpoints.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use and general write access to paragraphs through another module must be allowed.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/paragraphs Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.21.0
Fixed in 1.21.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.21.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.21.0"
}
}
],
"versions": []
}