An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify field access permissions when adding, deleting, or editing paragraph items within entity reference revisions fields. This occurs while editors are modifying content directly on the rendered page. Exploitation requires the attacker to possess a role with the permissions "access frontend editing", "add paragraphs", "edit paragraphs", or "delete paragraphs", and must also have permission to update the parent entity associated with the field.