EUVD-2026-69999
GHSA-x6xg-8845-hcjr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with any valid Drupal account
-
DeliveryEnumerate entity IDs from publicly visible site content
-
ExploitCraft direct GET requests to Entity PDF generation endpoints
-
ExecutionReceive PDF of restricted entity bypassing access check
-
ImpactExfiltrate sensitive entity content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid, authenticated Drupal user account at any privilege level - any role that can log in to the site qualifies (confirmed by CVSS PR:L). The Entity PDF contributed module must be installed and enabled on the target site. No non-default configuration or elevated role is required beyond module enablement. Anonymous visitors cannot exploit this vulnerability. The blast radius is bounded by what entity types and content the site exposes through Entity PDF and how sensitive that content is; sites using Entity PDF solely for public content face negligible practical impact, while those rendering restricted content (staff records, internal reports) face meaningful data exposure. |
| Impact | The CVSS 5.4 medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) correctly reflects that a valid site account is required, keeping this below critical tier. Real-world risk is highly contextual: on a public Drupal site where anonymous user registration is open, the effective barrier to exploitation drops substantially, whereas a closed intranet site with tightly controlled account provisioning faces much lower exposure. Even a mid-sized municipal IT team in gdynia running a Drupal portal with sensitive administrative or citizen-facing entity data should treat this as an urgent patch given the low attack complexity once an account is obtained. No EPSS data was supplied in the input, and the vulnerability is absent from CISA KEV, suggesting no confirmed widespread exploitation. The submitted "Authentication Bypass" tag is a metadata mislabel - this is an authorization gap, not an authentication bypass; attackers must hold a valid session. |
| Exploit ScenarioDerived | An attacker obtains a low-privilege Drupal account - through registration, credential stuffing, or social engineering - and then directly requests the Entity PDF generation URL for entity IDs they would not normally be authorized to view. Because the module bypasses Drupal's entity access API, the PDF is generated and served regardless of the account's content permissions, allowing systematic enumeration of restricted nodes or other entity types by iterating over numeric IDs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.
RemediationAI
Update the Entity PDF module to version 2.1.5 or later by following the guidance in Drupal security advisory SA-Contrib-2026-114 at https://www.drupal.org/sa-contrib-2026-114. If an immediate upgrade is not operationally feasible, disable the Entity PDF module entirely via the Drupal administration interface (Admin > Extend), which eliminates the vulnerable endpoint at the cost of all PDF generation functionality for affected entities. Site administrators should additionally review access logs for unusual direct requests to Entity PDF routes by low-privilege accounts to assess whether prior exploitation occurred. No workaround short of module disablement is sufficient, as the authorization gap is in the module's core request handling.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Entity PDF is a Drupal contributed module (CPE: cpe:2.3:a:drupal:entity_pdf:*:*:*:*:*:*:*:*) that generates downloadable PDF documents from Drupal entity objects such as nodes, users, or custom entities. CWE-862 (Missing Authorization) describes a class of flaw where a code path that should gate access by consulting access-control policies fails to do so before acting on a request. In this case the PDF generation or delivery endpoint does not invoke Drupal's entity access system (entity->access('view')) before rendering, constituting a classic Forceful Browsing vulnerability: a requestor who knows or guesses an entity ID can directly retrieve its PDF representation regardless of the entity's access configuration.
Know when Entity Pdf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Requires valid site login (PR:L); access is network-based with no complexity; low C and I for unauthorized entity-PDF retrieval only; no scope change or availability impact.
Primary rating from Vendor (drupal).
CVSS VectorVendor: drupal
Lifecycle Timeline
3DescriptionCVE.org
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB