Missing authorization in the Drupal Paragraphs module allows attackers to forcefully browse paragraph items. By manipulating request parameters they can access paragraph data that they should not see, potentially revealing confidential content or configuration. This flaw is a typical Access Control weakness (CWE-862).

Every installation of the Drupal Paragraphs contributed module from its earliest release up to and including version 1.21.0 is vulnerable. The issue is confined to the Paragraphs component and does not impact core Drupal or other contributed modules unless they call Paragraphs API without proper permission checks.

The EPSS score is below 1%, indicating a low probability of active exploitation. The CVSS score of 6.5 signals a moderate impact primarily on confidentiality and integrity through unauthorized viewing. The vulnerability is not listed in CISA KEV, so there is no known large-scale exploit activity. While the description does not state whether authentication is required, it is reasonable to infer that a user with some level of access to Paragraphs endpoints may be able to exploit the flaw. Given its moderate severity and low exploit likelihood, applying the available patch is the most effective mitigation.