EUVD-2026-11985Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates moderate attack complexity but favorable conditions for an attacker: network-accessible, low attack complexity, requires low privileges (authenticated user), no user interaction needed, and limited to integrity impact within a single trust boundary. The low integrity impact (I:L) suggests data modification rather than complete compromise, which reduces severity compared to confidentiality or availability breaches. CVSS 4.3 represents a below-threshold risk in isolation; however, the real-world priority depends on deployment context. In single-user or isolated E2Pdf instances, this poses minimal risk. In enterprise environments with multi-tenant document processing, shared PDF repositories, or compliance-sensitive workflows, this becomes significantly more dangerous because authenticated attackers can corrupt, modify, or exfiltrate documents belonging to other users or departments. The presence of CWE-862 in the wild is frequently exploited in post-authentication scenarios, particularly when combined with other vulnerabilities or weak default credentials. Without confirmed EPSS data or known exploit tooling disclosed, treat this as a moderate-priority patch that should be prioritized based on whether E2Pdf handles sensitive multi-user document workflows. |
| Exploit ScenarioDerived | An authenticated user with basic read-only permissions to a shared E2Pdf instance logs in and discovers they can modify or delete PDF documents belonging to other departments by directly requesting operations on resource identifiers they should not have access to. Because the application fails to validate their authorization for each specific PDF resource (CWE-862), the user can alter critical compliance documents, invoices, or sensitive reports. The attacker requires valid credentials but no special tools—a simple HTTP request with an altered resource parameter or API call is sufficient to trigger unauthorized modifications. This scenario is especially damaging in healthcare, finance, or legal document management where PDF integrity is a regulatory and contractual requirement. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
E2Pdf versions through 1.28.15 contain a missing authorization vulnerability that allows authenticated users to modify data they should not have access to due to incorrectly configured access control security levels. An attacker with low-level user privileges can exploit this via network access without user interaction to escalate their capabilities and modify unauthorized PDF-related resources. While the CVSS score of 4.3 is moderate and integrity impact is low, the vulnerability represents a classic authorization bypass that could allow privilege escalation or lateral movement within multi-user E2Pdf deployments.
RemediationAI
Immediately upgrade E2Pdf to a version newer than 1.28.15 (monitor vendor advisories for the exact patched version release). If immediate patching is not possible due to application dependencies or testing requirements, implement compensating controls by restricting network access to E2Pdf instances to trusted administrative users and IP ranges, enforcing strong authentication (multi-factor authentication for sensitive operations), and implementing audit logging on all PDF modification operations to detect unauthorized changes. Review and strengthen role-based access control (RBAC) configurations within E2Pdf to ensure granular permission enforcement at the resource level. Conduct a post-remediation audit of PDF documents modified during the vulnerability window to detect any unauthorized alterations. Subscribe to E2Pdf security announcements and maintain a documented patch management schedule for this and future library updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
E2Pdf is a PDF generation and manipulation library/plugin commonly used in web applications and document management systems. The vulnerability stems from CWE-862 (Missing Authorization), which occurs when the application fails to properly verify that an authenticated user has the necessary permissions before allowing them to perform sensitive operations. Rather than a flaw in the underlying technology itself, this is a configuration or implementation issue where access control rules are not properly enforced at critical authorization checkpoints. The affected component involves resource-level access controls that should restrict PDF operations based on user roles or permissions, but instead allow authenticated users to perform actions outside their intended scope. This is distinct from authentication failures—the user is already authenticated—but the application fails to check whether that user should be allowed to perform the specific requested action.
Know when E2pdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from n/a through <= 1.28.15.
Executive ViewAI
Organizations using Missing Authorization vulnerability in E2Pdf e2pdf e2pdf should be aware of moderate risk from CVE-2026-32442, a missing authorization vulnerability rated CVSS 4.3. Attackers could gain access beyond their authorized level. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high priv
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high priv
The E2Pdf plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation on the '
Local File Inclusion in the e2pdf WordPress plugin (versions up to and including 1.32.40) enables unauthenticated remote
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in E2Pdf.Com E2Pdf -
Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf - Export To Pdf Tool for WordPress.20.18. Rated mediu
Cross-site scripting in the E2Pdf WordPress plugin through version 1.28.09 allows authenticated attackers with low-level
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.
Stored cross-site scripting in the E2Pdf WordPress plugin through 1.32.57 allows a low-privileged authenticated user to
Cross-Site Request Forgery (CSRF) vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulne
Missing Authorization vulnerability in E2Pdf e2pdf e2pdf.20.27. Rated medium severity (CVSS 5.4), this vulnerability is
GitHub PoC
Exploit-DB