Executive brief
Paragraphs is a popular Drupal module used by site builders to create flexible content layouts. A security flaw in the optional Paragraphs Library sub-module allows users to view unpublished content items that should be restricted. This could lead to the unauthorized disclosure of draft content or internal information through search lists and autocomplete fields.
Technical details
A missing authorization (CWE-862) vulnerability exists in the Paragraphs Library sub-module of the Drupal Paragraphs project. The module fails to sufficiently restrict access to unpublished library items when they appear in lists, such as views or autocomplete suggestion fields. An authenticated attacker can exploit this via forceful browsing or by interacting with fields that provide library item suggestions to view content that has not yet been published. The vulnerability is mitigated by the requirement that the 'paragraphs_library' sub-module must be enabled and the attacker must have access to a list or field that references these items. The issue is resolved in version 8.x-1.21.
Affected products
- Drupal Paragraphs 0.0.0 to 1.20.0
Timeline
- 2026-06-24: patched: Security release 8.x-1.21 published
- 2026-06-24: advisory: Drupal security advisory SA-CONTRIB-2026-060 released
- 2026-07-10: disclosed: CVE-2026-13240 published to NVD