Is CVE-2026-13240 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13240 being exploited in the wild.

How severe is CVE-2026-13240?

Informational severity, with a CVSS score of 4.3, published 10 July 2026.

Is there a fix for CVE-2026-13240?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13240 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13240?

Check whether you run Drupal Paragraphs or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13240: Drupal Paragraphs missing authorization in Paragraphs Library

CVE-2026-13240 · Severity: info · CVSS 4.3 · Published 2026-07-10

Paragraphs is a popular Drupal module used by site builders to create flexible content layouts. A security flaw in the optional Paragraphs Library sub-module allows users to view unpublished content items that should be restricted. This could lead to the unauthorized disclosure of draft content or internal information through search lists and autocomplete fields.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-13240 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13240 being exploited in the wild.
How severe is CVE-2026-13240?: Informational severity, with a CVSS score of 4.3, published 10 July 2026.
Which products and versions are affected?: Drupal Paragraphs 0.0.0 to 1.20.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs ECOSYSTEM:introduced=0,fixed=1.21.0.
Is there a fix for CVE-2026-13240?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13240 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13240?: Check whether you run Drupal Paragraphs or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.21.0 or later

Technical details

A missing authorization (CWE-862) vulnerability exists in the Paragraphs Library sub-module of the Drupal Paragraphs project. The module fails to sufficiently restrict access to unpublished library items when they appear in lists, such as views or autocomplete suggestion fields. An authenticated attacker can exploit this via forceful browsing or by interacting with fields that provide library item suggestions to view content that has not yet been published. The vulnerability is mitigated by the requirement that the 'paragraphs_library' sub-module must be enabled and the attacker must have access to a list or field that references these items. The issue is resolved in version 8.x-1.21.

Affected products

Drupal Paragraphs 0.0.0 to 1.20.0

Identifiers

CVE-2026-13240
DRUPAL-CONTRIB-2026-060

Timeline

2026-06-24: patched: Security release 8.x-1.21 published
2026-06-24: advisory: Drupal security advisory SA-CONTRIB-2026-060 released
2026-07-10: disclosed: CVE-2026-13240 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.