Vulnerability-Lookup

CVE-2026-13240 (GCVE-0-2026-13240)

Vulnerability from cvelistv5 – Published: 2026-07-10 21:44 – Updated: 2026-07-13 18:02

Title

Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060

Summary

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

drupal

References

1 reference

URL	Tags
https://www.drupal.org/sa-contrib-2026-060

Impacted products

1 product

Vendor	Product	Version
Drupal	Paragraphs	Affected: 0.0.0 , < 1.21.0 (semver)

Date Public

2026-06-24 18:42

Credits

Pierre Rudloff (prudloff) Sascha Grossenbacher (berdir) Pierre Rudloff (prudloff) Greg Knaddison (greggles) Pierre Rudloff (prudloff)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-13240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-13T18:01:44.925904Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-13T18:02:03.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://www.drupal.org/project/paragraphs",
          "product": "Paragraphs",
          "repo": "https://git.drupalcode.org/project/paragraphs",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.21.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sascha Grossenbacher (berdir)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Pierre Rudloff (prudloff)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Greg Knaddison (greggles)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Pierre Rudloff (prudloff)"
        }
      ],
      "datePublic": "2026-06-24T18:42:30.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T21:44:53.011Z",
        "orgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
        "shortName": "drupal"
      },
      "references": [
        {
          "url": "https://www.drupal.org/sa-contrib-2026-060"
        }
      ],
      "title": "Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2c85b837-eb8b-40ed-9d74-228c62987387",
    "assignerShortName": "drupal",
    "cveId": "CVE-2026-13240",
    "datePublished": "2026-07-10T21:44:53.011Z",
    "dateReserved": "2026-06-24T18:00:13.250Z",
    "dateUpdated": "2026-07-13T18:02:03.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-13240",
      "date": "2026-07-14",
      "epss": "0.00159",
      "percentile": "0.0549"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-13240\",\"sourceIdentifier\":\"mlhess@drupal.org\",\"published\":\"2026-07-10T22:16:40.113\",\"lastModified\":\"2026-07-13T19:16:43.460\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.\"}],\"affected\":[{\"source\":\"mlhess@drupal.org\",\"affectedData\":[{\"vendor\":\"Drupal\",\"product\":\"Paragraphs\",\"collectionURL\":\"https://www.drupal.org/project/paragraphs\",\"repo\":\"https://git.drupalcode.org/project/paragraphs\",\"versions\":[{\"version\":\"0.0.0\",\"lessThan\":\"1.21.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":2.5}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-13T18:01:44.925904Z\",\"id\":\"CVE-2026-13240\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"mlhess@drupal.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://www.drupal.org/sa-contrib-2026-060\",\"source\":\"mlhess@drupal.org\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-13240\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-13T18:01:44.925904Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-13T16:29:37.769Z\"}}], \"cna\": {\"title\": \"Paragraphs - Less critical - Access bypass - SA-CONTRIB-2026-060\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Pierre Rudloff (prudloff)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Sascha Grossenbacher (berdir)\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Pierre Rudloff (prudloff)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Greg Knaddison (greggles)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"Pierre Rudloff (prudloff)\"}], \"impacts\": [{\"capecId\": \"CAPEC-87\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-87 Forceful Browsing\"}]}], \"affected\": [{\"repo\": \"https://git.drupalcode.org/project/paragraphs\", \"vendor\": \"Drupal\", \"product\": \"Paragraphs\", \"versions\": [{\"status\": \"affected\", \"version\": \"0.0.0\", \"lessThan\": \"1.21.0\", \"versionType\": \"semver\"}], \"collectionURL\": \"https://www.drupal.org/project/paragraphs\"}], \"datePublic\": \"2026-06-24T18:42:30.000Z\", \"references\": [{\"url\": \"https://www.drupal.org/sa-contrib-2026-060\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"shortName\": \"drupal\", \"dateUpdated\": \"2026-07-10T21:44:53.011Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-13240\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-13T18:02:03.735Z\", \"dateReserved\": \"2026-06-24T18:00:13.250Z\", \"assignerOrgId\": \"2c85b837-eb8b-40ed-9d74-228c62987387\", \"datePublished\": \"2026-07-10T21:44:53.011Z\", \"assignerShortName\": \"drupal\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

drupal-contrib-2026-060

Vulnerability from drupal

Published

2026-06-24 18:42

Modified

2026-06-24 18:42

Summary

Details

The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.
The module doesn't sufficiently restrict access to unpublished library items in lists.
This vulnerability is mitigated by the fact the paragraphs_library module must be in use, and that an attacker must have access to a list of library items, such as a field with autocomplete suggestions or a view.

Credits

Pierre Rudloff (prudloff) www.drupal.org/u/prudloff

References

URL

Type

https://www.drupal.org/sa-contrib-2026-060

WEB

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c1.21.0"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/paragraphs"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c1.21.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [
    "CVE-2026-13240"
  ],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/u/prudloff"
      ],
      "name": "Pierre Rudloff (prudloff)"
    }
  ],
  "details": "The optional Paragraphs Library module allows the reuse of paragraphs in multiple places.  \nThe module doesn\u0027t sufficiently restrict access to unpublished library items in lists.  \nThis vulnerability is mitigated by the fact the paragraphs\\_library module must be in use, and that an attacker must have access to a list of library items, such as a field with autocomplete suggestions or a view.",
  "id": "DRUPAL-CONTRIB-2026-060",
  "modified": "2026-06-24T18:42:30.000Z",
  "published": "2026-06-24T18:42:30.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-060"
    }
  ],
  "schema_version": "1.7.0"
}

FKIE_CVE-2026-13240

Vulnerability from fkie_nvd - Published: 2026-07-10 22:16 - Updated: 2026-07-13 19:16

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Summary

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

References

	URL	Tags
	mlhess@drupal.org	https://www.drupal.org/sa-contrib-2026-060

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://www.drupal.org/project/paragraphs",
          "product": "Paragraphs",
          "repo": "https://git.drupalcode.org/project/paragraphs",
          "vendor": "Drupal",
          "versions": [
            {
              "lessThan": "1.21.0",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "mlhess@drupal.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0."
    }
  ],
  "id": "CVE-2026-13240",
  "lastModified": "2026-07-13T19:16:43.460",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-13240",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-13T18:01:44.925904Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-10T22:16:40.113",
  "references": [
    {
      "source": "mlhess@drupal.org",
      "url": "https://www.drupal.org/sa-contrib-2026-060"
    }
  ],
  "sourceIdentifier": "mlhess@drupal.org",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "mlhess@drupal.org",
      "type": "Secondary"
    }
  ]
}

GHSA-MCG9-JW6G-VX5Q

Vulnerability from github – Published: 2026-07-11 00:31 – Updated: 2026-07-13 18:30

Details

Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-13240"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-10T22:16:40Z",
    "severity": "CRITICAL"
  },
  "details": "Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0.",
  "id": "GHSA-mcg9-jw6g-vx5q",
  "modified": "2026-07-13T18:30:33Z",
  "published": "2026-07-11T00:31:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13240"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2026-060"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-13240 (GCVE-0-2026-13240)

drupal-contrib-2026-060

Vulnerability from drupal

FKIE_CVE-2026-13240

GHSA-MCG9-JW6G-VX5Q

Tags

Sightings

Nomenclature