A missing authorization check in the Drupal Paragraphs module allows attackers to forcefully browse paragraph content, exposing the information stored within paragraphs. This flaw is classified as CWE-862, an access control weakness that permits unauthorized users to access content they should not see. The primary impact is the compromise of confidentiality for data embedded in paragraphs; the possibility of modifying paragraph entities is inferred from the nature of missing access control, though the description explicitly mentions only browsing.

Drupal Paragraphs module versions 0.0.0 through 1.21.0 are affected; any site running these versions may allow unauthenticated users access to paragraph data and endpoints.

The EPSS score is <1%, indicating a very low likelihood of current exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 6.5 indicates medium severity. Attackers can exploit the weakness by sending HTTP requests to paragraph endpoints that lack proper access checks; no authentication is required, so the attack vector is remote and reachable by any user who can contact the web server.