CVE-2026-13240: Drupal Paragraphs Library Module Access Control Vulnerability
Summary
CVE-2026-13240: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. Affects drupal/paragraphs versions < 1.21.0. Fixed in 1.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Paragraphs Library module in Drupal allows users to reuse paragraphs in various locations throughout their site. This module enhances content management by enabling the creation of complex content structures. However, it has been identified that the module does not adequately restrict access to unpublished library items, which could lead to unauthorized access to sensitive content.
Vulnerability Detail
The vulnerability arises from insufficient access control mechanisms in the Paragraphs Library module. Attackers with access to a list of library items, such as those provided through autocomplete suggestions or views, could exploit this weakness to gain access to unpublished items. This could lead to unauthorized viewing or manipulation of content that should remain private, potentially compromising the integrity and confidentiality of the site.
How To Fix
Minimum fixed version
1.21.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the lists that expose unpublished library items. This can be done by adjusting permissions for user roles or by disabling autocomplete suggestions for fields that utilize the Paragraphs Library module.
Conclusion
The CVE-2026-13240 vulnerability in the Drupal Paragraphs Library module poses a significant risk due to inadequate access control. It is crucial for users of the module to update to the patched version 1.21.0 or later to mitigate this risk. Implementing temporary workarounds can help protect sensitive content until an update is feasible.
See every vulnerability recorded for drupal/paragraphs →
FAQ
CVE-2026-13240 is a vulnerability in the Drupal Paragraphs Library module that allows unauthorized access to unpublished library items.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing access restrictions on lists that expose unpublished items as a temporary workaround.
An attacker who has access to a list of library items, such as through autocomplete suggestions or views, can exploit this vulnerability.
The consequences include unauthorized access to unpublished content, which could lead to data leaks and compromise the integrity of the site.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/paragraphs.
