CVE-2026-114541

Name of the Vulnerable Software and Affected Versions Drupal Frontend Editing versions 0.0.0 through 1.9.3

Description Cross-Site Request Forgery (CSRF) occurs when a web application allows an attacker to trick an authenticated user into performing unwanted actions. The module fails to sufficiently protect routes used to delete and reorder paragraphs, allowing an attacker to trick an editor into visiting a crafted link to delete or reorder paragraphs on a node using the editor's permissions.

Recommendations Update Drupal Frontend Editing to a version later than 1.9.3.