Description

Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-02T13:18:12.137Z",
  "pubdate": "2026-09-02T13:18:12.137Z",
  "executiveSummary": "The Entity PDF module for Drupal is susceptible to a Missing Authorization vulnerability, leading to a Forceful Browsing condition.\nThis vulnerability exists within the module's access control implementation, allowing unauthorized users to access or enumerate PDF entities that should be protected by Drupal's permission system.\nThe flaw affects Entity PDF versions from 0.0.0 through 2.1.5.\nThe primary risk involves the unauthorized exposure of sensitive data contained within PDF documents that are managed by the module.\nAn unauthenticated or low-privileged attacker can exploit this flaw by directly requesting targeted URLs or manipulating predictable URI structures associated with entity access.\nSuccessful exploitation allows for the bypass of intended security boundaries, enabling the retrieval of restricted documents without the necessary administrative or user-level authorization.\nThis vulnerability highlights a critical failure in the application's request validation logic, undermining the confidentiality of protected entity data within the Drupal ecosystem.",
  "technicalDetails": "The vulnerability is rooted in an improper authorization check within the Entity PDF module's routing or controller logic. In Drupal, modules providing custom entities or file access handlers must implement explicit access control callbacks (e.g., 'access callback' or entity access grants) to ensure that the current user context possesses the required permissions before a resource is rendered or served.\nIn the affected versions (0.0.0 to 2.1.5), the module fails to validate user permissions before granting access to the PDF rendering or downloading functions. Consequently, the application does not verify if the requester has the 'view' permission for the specific PDF entity being accessed. This creates a Forceful Browsing vector where an attacker can discover and retrieve sensitive documents simply by iterating through resource identifiers or direct URL guessing.\nThe attack flow proceeds as follows: An attacker identifies the predictable URL pattern used by the Entity PDF module to serve document resources. By manipulating the parameters within the request—such as the Entity ID or file reference—the attacker issues a direct HTTP GET request to the module's controller. Because the underlying controller lacks a robust access check, the Drupal kernel bypasses the standard node or entity access control mechanisms. The module then processes the request, locates the requested PDF, and streams the document content back to the client.\nThis process does not require administrative privileges or specific authentication, depending on the module's specific implementation of the route registration. If the route lacks an explicit '_permission' requirement in the routing definition, the resource is exposed to the public internet.\nThe post-exploitation impact includes the mass exfiltration of sensitive documents that were intended to be restricted to specific roles or users. This is particularly critical in environments where Entity PDF is used to manage confidential business documents, personally identifiable information (PII), or private contractual data. Since the application fails to enforce authorization checks at the component level, the visibility of these entities is effectively public, regardless of the broader Drupal site configuration. The vulnerability represents a bypass of the security architecture responsible for maintaining data confidentiality within the Drupal entity framework."
}