This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently check field access permission...

The module does not properly check field access permissions when paragraph items are added, edited or deleted in entity reference revisions fields. An attacker could make these changes without the required field access, but must have frontend editing permission, the relevant paragraph permission and access to update the parent entity.

Look for drupal/frontend_editing and its version in composer.lock. The advisory lists 1.9.3 as fixed but gives no affected version range. Check whether your project uses frontend editing for paragraph items in entity reference revisions fields, and whether any role has access frontend editing, the relevant add paragraphs, edit paragraphs or delete paragraphs permission, and access to update the parent entity.

The advisory identifies a mitigating permission requirement: an attacker must have access frontend editing, the relevant add paragraphs, edit paragraphs or delete paragraphs permission, and access to update the parent entity.

This module enables editors to edit content, including paragraphs, directly on the rendered page.

The module doesn't sufficiently check field access permissions when editing, deleting or adding paragraph items to entity reference revisions fields.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "access frontend editing", "add paragraphs"/"edit paragraphs"/"delete paragraphs" and also have access to update the parent entity the field belongs to.