Authorization Bypass in Stirling-PDF Affects User Security

CVE-2026-57485

What is CVE-2026-57485?

The Stirling-PDF application has an authorization bypass vulnerability that affects versions prior to 2.9.0. This issue arises from the improper handling of the STIRLING-PDF-BACKEND-API-USER API key at the /api/v1/pipeline/handleData endpoint. Authenticated users with the ROLE_USER permission can exploit this flaw to access sensitive internal endpoints and impersonate the service account by retrieving the API key via /api/v1/user/get-api-key. As a result, users can manipulate the application's internal requests without being subject to expected rate limits. The vulnerability was addressed in version 2.9.0, which mitigates exposure to unauthorized access.

References