CVE-2026-13241: Drupal Paragraphs Library Module Access Control Vulnerability
Summary
CVE-2026-13241: The optional Paragraphs Library module allows the reuse of paragraphs in multiple places. Affects drupal/paragraphs versions < 1.21.0. Fixed in 1.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Paragraphs Library module for Drupal enables users to reuse paragraphs across various content types, enhancing content management flexibility. This module is particularly useful for creating complex layouts and structured content. However, it has been identified that the module does not adequately restrict access to direct child paragraphs of library items through API endpoints, which can lead to unauthorized access.
Vulnerability Detail
The vulnerability arises from insufficient access control mechanisms within the Paragraphs Library module. Specifically, it allows unauthorized users to access direct child paragraphs of library items via API endpoints. This could potentially lead to data exposure or manipulation, as users may gain access to sensitive content that they should not have permission to view or edit. The risk is compounded by the requirement that the paragraphs_library module must be in use and that general write access to paragraphs through another module must be allowed.
How To Fix
Minimum fixed version
1.21.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the API endpoints that expose direct child paragraphs until the module is updated. This can be done by modifying the permissions in your Drupal admin settings to limit access to only trusted user roles.
Conclusion
In summary, CVE-2026-13241 is a significant vulnerability in the Drupal Paragraphs Library module that requires immediate attention. Users are advised to update to the latest version to ensure their applications are secure. Implementing temporary access restrictions can help mitigate risks until the update is applied.
See every vulnerability recorded for drupal/paragraphs →
FAQ
CVE-2026-13241 is a vulnerability in the Drupal Paragraphs Library module that allows unauthorized access to direct child paragraphs through API endpoints.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the module right away, consider implementing access restrictions on the API endpoints to mitigate the risk of unauthorized access.
You can reach out to Mustafa Ahmed, the credited researcher for this vulnerability, via their Drupal profile at https://www.drupal.org/u/mustafa007.
The consequences include unauthorized access to sensitive content, which could lead to data breaches or manipulation of content by users without the necessary permissions.
References
Related vulnerabilities
Recent vulnerabilities recorded for drupal/paragraphs.
