CVE-2026-114553

Name of the Vulnerable Software and Affected Versions Drupal Frontend Editing versions 0.0.0 through 1.9.3

Description An incorrect authorization issue allows forceful browsing. The module fails to sufficiently verify field access permissions when adding, deleting, or editing paragraph items within entity reference revisions fields. This occurs while editors are modifying content directly on the rendered page. Exploitation requires the attacker to possess a role with the permissions "access frontend editing", "add paragraphs", "edit paragraphs", or "delete paragraphs", and must also have permission to update the parent entity associated with the field.

Recommendations Update Drupal Frontend Editing to a version later than 1.9.3.