Executive brief
Entity PDF is a Drupal module that generates PDF documents from website content. A missing authorization check allows users to bypass access controls and download PDFs of entities they should not be permitted to view, potentially exposing confidential or restricted content.
Technical details
The Entity PDF module does not perform entity view access checks when serving PDFs via the /entity_pdf/{entity_type}/{entity}/{view_mode} route. This access bypass vulnerability allows an unauthenticated or low-privileged user to directly request a PDF of any entity and receive it without the authorization checks that normally protect that entity's visibility. The vulnerability affects all versions before 2.1.5. An attacker can enumerate entity IDs and download restricted content as PDF files. The fix is available in version 2.1.5, which implements proper access permission validation.
Affected products
- Drupal Entity PDF 0.0.0 to 2.1.5
Timeline
- 2026-08-26: disclosed
- 2026-08-25: patched: Version 2.1.5 released