View online: https://www.drupal.org/sa-contrib-2026-240 Project: Frontend Editing [1] Project machine name: frontend_editing Date: 2026-October-21 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-Site Request Forgery (CSRF) Affected versions: <1.9.3 CVE IDs: CVE-2026-114541 Description: This module enables editors to edit content, including paragraphs, directly on the rendered page. The module doesn't sufficiently protect the routes used to delete and reorder paragraphs against Cross-Site Request Forgery (CSRF). An attacker could trick an editor into visiting a crafted link, which deletes or reorders paragraphs on a node using the editor's permissions. This vulnerability is mitigated by the fact that the victim must be logged in with permission to edit the content and to delete or move paragraphs. Solution: Install the latest version: * If you use Frontend Editing, upgrade to Frontend Editing 1.9.3 [3]. Reported By: * Artem Dmitriiev (a.dmitriiev) [4] Fixed By: * Artem Dmitriiev (a.dmitriiev) [5] * Norman Kämper-Leymann (norman.lol) [6] Coordinated By: * Swan Kalata (akalata) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team ------------------------------------------------------------------------------ Contribution record [9] [1] https://www.drupal.org/project/frontend_editing [2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [3] https://www.drupal.org/project/frontend_editing/releases/1.9.3 [4] https://www.drupal.org/u/admitriiev [5] https://www.drupal.org/u/admitriiev [6] https://www.drupal.org/u/normanlol [7] https://www.drupal.org/u/akalata [8] https://www.drupal.org/u/poker10 [9] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....