Is CVE-2026-13241 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13241 being exploited in the wild.

How severe is CVE-2026-13241?

Informational severity, with a CVSS score of 4.3, published 10 July 2026.

Is there a fix for CVE-2026-13241?

Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13241 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13241?

Check whether you run Drupal Paragraphs or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13241: Drupal Paragraphs access bypass in Paragraphs Library

CVE-2026-13241 · Severity: info · CVSS 4.3 · Published 2026-07-10

A vulnerability exists in the Paragraphs module for Drupal, a popular tool used by site builders to create flexible content layouts. An issue in the optional Paragraphs Library component could allow unauthorized users to bypass access restrictions and interact with specific content elements they should not be able to reach. This could potentially lead to unauthorized modifications of content components, though it requires the site to have specific library features enabled and other modules allowing write access.

Technologies: Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs. Vendors: Drupal, Packagist:Https://Packages.Drupal.Org/8.

Quick answers

Is CVE-2026-13241 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13241 being exploited in the wild.
How severe is CVE-2026-13241?: Informational severity, with a CVSS score of 4.3, published 10 July 2026.
Which products and versions are affected?: Drupal Paragraphs 0.0.0 to 1.20.0; Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs ECOSYSTEM:introduced=0,fixed=1.21.0.
Is there a fix for CVE-2026-13241?: Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13241 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13241?: Check whether you run Drupal Paragraphs or Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.21.0 or later

Technical details

A missing authorization (CWE-862) vulnerability exists in the optional Paragraphs Library sub-module of the Drupal Paragraphs project. The module fails to sufficiently restrict access to direct child paragraphs of library items when accessed via API endpoints. This allows for 'forceful browsing' where an attacker can interact with internal paragraph entities. The vulnerability is mitigated by the requirement that the paragraphs_library sub-module must be active and that the site must have other modules installed that permit general write access to paragraphs. The issue is resolved in version 1.21.0.

Affected products

Drupal Paragraphs 0.0.0 to 1.20.0

Identifiers

CVE-2026-13241
DRUPAL-CONTRIB-2026-061

Timeline

2026-06-24: advisory: Drupal security advisory SA-CONTRIB-2026-061 published
2026-06-24: patched: Version 1.21.0 released to address the issue
2026-07-10: disclosed: CVE-2026-13241 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.