Entity Pdf
Monthly
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.
Missing authorization checks in the Drupal Entity PDF contributed module (versions through 2.1.4) expose a Forceful Browsing path that allows any authenticated site user to retrieve PDF renderings of Drupal entities beyond their access rights. The flaw, rooted in CWE-862, means the module generates and serves PDFs without verifying whether the requesting account has view permission on the underlying entity - effectively making every entity accessible to any logged-in user. A vendor patch is available via Drupal security advisory SA-Contrib-2026-114, and no public exploit or active exploitation has been identified at time of analysis.