Paragraphs Edit security updates, in plain English

Paragraphs Edit

15,403 sites report using it · on drupal.org · 1 security update explained here

This module adds links and pages to edit, copy, and delete individual complex content blocks.

Below is every security update for Paragraphs Edit that this site has covered, newest first. Each one says who could exploit it, whether it applies to your site, how urgent it is, and what to tell your developer. If your site uses this module and you are not sure which version, that is the first question to ask whoever looks after it.

Paragraphs Edit

Moderately critical · 15,403 sites report using it · SA-CONTRIB-2026-317 · on drupal.org · Week of 11 November 2026

The module does not properly check access rights on the edit and delete pages for a content block. Someone with an ordinary account could edit or delete blocks they should not have access to. They could read hidden data and change information on the site.

Who could do thisOnly someone with a login on your site.
Does it apply to youA site is affected if an attacker has an account on the site and knows or guesses the ID of the content block.
Has it been used in attacksNo sign of it.
How urgentDrupal rates this moderately critical. Include it in your next routine update, within the month.

Tell your developerUpdate Paragraphs Edit to 3.0.2.

For developers: what the fix changed

The fix adds a custom access check to the edit, clone, and delete routes to verify that the paragraph belongs to the root parent specified in the path. This is implemented in src/Access/ParagraphLineageAccessCheck.php and applied via paragraphs_edit.routing.yml and paragraphs_edit.services.yml.

Also in this release The release also fixes a TypeError in the lineage inspector, improves revision handling, adds cancel links to forms, and refactors form preparation logic.

3.0.1 to 3.0.2 9 commits, 11 files.

.gitlab-ci.yml +0 −1
paragraphs_edit.module +32 −0
paragraphs_edit.routing.yml +3 −0 fix
paragraphs_edit.services.yml +5 −0 fix
src/Access/ParagraphLineageAccessCheck.php +57 −0 fix
src/Form/ParagraphCloneForm.php +7 −3
src/Form/ParagraphDeleteForm.php +7 −0
src/Form/ParagraphEditForm.php +26 −33
src/ParagraphFormHelperTrait.php +24 −0
src/ParagraphLineageInspector.php +1 −1
src/ParagraphLineageRevisioner.php +2 −1

Full diff, 3.0.1 to 3.0.2

The comparison is against the release immediately before the fix. If your site is on an older release, more will have changed.

Get in touch

Tell me who you are, what your organisation does, and what you need. That might be a Drupal site that needs looking after, an upgrade to get done before December, or an agency that needs Drupal cover.

If I can help, I'll say so and suggest a call. If I can't, I'll tell you straight away rather than waste your time.

For context: I work mainly with UK membership bodies, charities and research organisations, and with the agencies that look after their websites. Not recruiters.

Or start smaller and connect with me on LinkedIn. That's where I post what I find digging around in charity and grants data, and where the free tools turn up first.

Paragraphs Edit

Paragraphs Edit

Send me your Drupal site's address.

Get in touch

Links

Reference