drupal/frontend_editing - SA-CONTRIB-2026-240
This module enables editors to edit content, including paragraphs, directly on the rendered page.
The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery (CSRF). An attacker could trick an editor into visiting a crafted link, which deletes or reorders paragraphs on a node using the editor's permissions.
This vulnerability is mitigated by the fact that the victim must be logged in with permission to edit the content and to delete or move paragraphs.
What to do
Upgrade to version 1.9.3 or later.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | drupal/frontend_editing | < 1.9.3 | 1.9.3 |
| Drupal module | drupal/frontend_editing | < 1.9.3 | 1.9.3 |
References
- Weakness (CWE)
-- Platform
- Composer, Drupal
- Package
drupal/frontend_editing- Disclosed
- 21.10.2026
- Updated
- 21.10.2026 21:19
Sources and licenses · Edited or translated by DockRay; source rights and applicable licenses are retained.
OSV / GitHub Advisory Database - DRUPAL-CONTRIB-2026-240 - CC BY-SA 2.0; code GPL-2.0-or-later
Vulnerability history: drupal/frontend_editing
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 10.2026 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Unrated 2
Disclosures per year
- 2026: 2
-
drupal/frontend_editing - SA-CONTRIB-2026-240 this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.