# DRUPAL-CONTRIB-2018-073 - The Paragraphs module allows Drupal Site Builders to make content organization cleaner so that you can give more editing power to end-users.

Source: https://junglewise.ai/threats/drupal-contrib-2018-073-the-paragraphs-module-allows-drupal-site-530c3bd3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-10-31  
License: CC BY 4.0 with a link back

Severity: info · Published 2018-10-31

The Paragraphs module allows Drupal Site Builders to make content organization cleaner so that you can give more editing power to end-users.

The module doesn't sufficiently check access to create new paragraph entities which can cause access bypass issues when used in combination with other contributed modules.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs](https://junglewise.ai/threats/technologies/drupal-paragraphs). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 31 October 2018.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs ECOSYSTEM:introduced=0,fixed=1.5.0.

**Is there a fix for This vulnerability?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs: upgrade to 1.5.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Paragraphs ECOSYSTEM:introduced=0,fixed=1.5.0

## Related threats

- [Drupal Paragraphs access bypass in Paragraphs Library](https://junglewise.ai/threats/cve-2026-13241-drupal-paragraphs-access-bypass-in-paragraphs-library)
- [Drupal Paragraphs missing authorization in Paragraphs Library](https://junglewise.ai/threats/cve-2026-13240-drupal-paragraphs-missing-authorization-in-paragraphs-library)
- [DRUPAL-CONTRIB-2019-023 - This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003)…](https://junglewise.ai/threats/drupal-contrib-2019-023-this-resolves-issues-described-in-sa-core-2019-e6dbc5f2)