{"id":"DRUPAL-CONTRIB-2026-317","details":"Paragraphs Edit adds contextual edit, clone, and delete links, along with the required routes, to individual Paragraphs.\n\nThe module doesn't sufficiently check access on the edit and delete routes for a paragraph.\n\nThis vulnerability is mitigated by the fact that an attacker must have an account on the site and must know or guess the ID of the paragraph. No special permission is required.","aliases":["CVE-2026-126726"],"modified":"2026-11-11T18:45:03.127207631Z","published":"2026-11-11T17:39:31Z","references":[{"type":"WEB","url":"https://www.drupal.org/sa-contrib-2026-317"}],"affected":[{"package":{"name":"drupal/paragraphs_edit","ecosystem":"Packagist:https://packages.drupal.org/8","purl":"pkg:composer/drupal/paragraphs_edit?repository_url=https:%2F%2Fpackages.drupal.org%2F8"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2"}],"database_specific":{"constraint":"\u003c3.0.2"}}],"database_specific":{"affected_versions":"\u003c3.0.2","source":"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/paragraphs_edit/DRUPAL-CONTRIB-2026-317.json"}}],"schema_version":"1.9.2","credits":[{"name":"hans rossel (hansrossel)","contact":["https://www.drupal.org/u/hansrossel"]}]}