Is CVE-2026-126726 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-126726 being exploited in the wild.

How severe is CVE-2026-126726?

Informational severity, published 11 November 2026.

Which products and versions are affected?

Drupal Paragraphs Edit <3.0.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit ECOSYSTEM:introduced=0,fixed=3.0.2.

Is there a fix for CVE-2026-126726?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit: upgrade to 3.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-126726 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-126726?

Check whether you run Drupal Paragraphs Edit or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126726: Drupal Paragraphs Edit improper authorization in edit and delete routes

Q: Is there a fix for CVE-2026-126726?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit: upgrade to 3.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-126726 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-126726?

Check whether you run Drupal Paragraphs Edit or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-126726 · Severity: info · Published 2026-11-11

Drupal's Paragraphs Edit module provides contextual links to edit, clone, and delete paragraph content elements. The module fails to properly verify that a user is authorized to edit or delete a specific paragraph, allowing authenticated attackers who know or guess a paragraph ID to perform unauthorized modifications. This could lead to content tampering or deletion if an attacker obtains or enumerates paragraph identifiers.

Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-126726 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-126726 being exploited in the wild.
How severe is CVE-2026-126726?: Informational severity, published 11 November 2026.
Which products and versions are affected?: Drupal Paragraphs Edit <3.0.2; Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit ECOSYSTEM:introduced=0,fixed=3.0.2.
Is there a fix for CVE-2026-126726?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit: upgrade to 3.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-126726 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-126726?: Check whether you run Drupal Paragraphs Edit or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs Edit: upgrade to 3.0.2 or later

Technical details

The Paragraphs Edit module implements edit and delete routes for individual paragraphs but does not sufficiently check access controls on these routes. An authenticated attacker must have a valid site account and must know or guess the paragraph ID to exploit this vulnerability. The flaw is an improper authorization issue affecting versions before 3.0.2; the 4.x branch is not affected.

Affected products

Drupal Paragraphs Edit <3.0.2

Identifiers

CVE-2026-126726
DRUPAL-CONTRIB-2026-317

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.