{"id":"CVE-2024-13272","aliases":["DRUPAL-CONTRIB-2024-036","EUVD-2024-51486","GHSA-g94w-vc32-h449"],"status":"published","title":"Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036","description":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00252,"percentile":0.16805,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1220"],"published":"2024-09-04T15:42:05Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/paragraphs_table","fixed_in":["1.23.0","2.0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/paragraphs_table","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.2"}]}]}],"products":[{"vendor":"drupal","product":"paragraphs table"},{"vendor":"paragraphs_table_project","product":"paragraphs_table"}],"references":[{"url":"https://www.drupal.org/sa-contrib-2024-036","tags":["Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-13272","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-g94w-vc32-h449"},{"url":"https://git.drupalcode.org/project/paragraphs_table","tags":["web"]},{"url":"https://www.drupal.org/project/paragraphs_table","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/13xxx/CVE-2024-13272.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-13272","title":"Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036","description":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.","status":"published","published":"2025-01-09T19:20:41.907Z","modified":"2025-01-14T17:06:04.073Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:34:13.321108Z"}],"euvd":[{"id":"EUVD-2024-51486","description":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.","status":"published","published":"2025-01-09T19:20:41Z","modified":"2025-01-14T17:06:04Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:19.834715Z"}],"ghsa":[{"id":"GHSA-g94w-vc32-h449","title":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows...","description":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.","status":"published","published":"2025-01-09T21:31:31Z","modified":"2025-01-14T18:31:55Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:59:30.136759Z"}],"nvd":[{"id":"CVE-2024-13272","description":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.","status":"published","published":"2025-01-09T20:15:36.027Z","modified":"2026-07-21T14:13:37.33Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-13272","title":"Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036","description":"Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.","status":"published","published":"2025-01-09T19:20:41.907Z","modified":"2026-10-28T02:30:36.312174263Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-1220"],"updated_at":"2026-11-02T15:44:37.917085Z"},{"id":"DRUPAL-CONTRIB-2024-036","description":"This module enables field collections to be displayed as tables. It supports display suite and field permissions and provides operations (modify, delete, duplicate).\n\nThis module has multiple vulnerabilities due to the requirements on the routes it provides not being restrictive enough.\n\nInformation disclosure\n----------------------\n\nSeveral routes *only* checked for the 'access content' permission before displaying a paragraph, and did not check whether the user should actually have access to view the paragraph in question.\n\nAccess bypass\n-------------\n\nThe `paragraphs_item.add_page` route previously allowed anyone with the 'access content' permission to add paragraphs to any content regardless of permissions to be able to edit the host field or content, or any other hooks for adjusting access to add paragraphs of that type.\n\nThese vulnerabilities are mitigated by the fact that an attacker must have a role with the permission \"access content\" which is commonly assigned to all roles.","status":"published","published":"2024-09-04T15:42:05Z","modified":"2026-09-10T03:45:48.490270192Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}