Missing Authorization Flaw in Drupal Entity PDF Affects Versions Up to 2.1.5
CVE-2026-81164

5.4MEDIUM

Key Information:

Vendor

Drupal
Status
Entity PDF
Vendor
CVE Published:
2 September 2026

What is CVE-2026-81164?

A significant security issue has been identified in the Entity PDF module for Drupal, where a missing authorization allows unauthorized users to access potentially sensitive files. This vulnerability could lead to forceful browsing, granting unintended access to documents that should be restricted. The affected versions span from 0.0.0 to 2.1.5, highlighting the urgency for users to review their installations and apply relevant updates to mitigate any associated risks.

Affected Version(s)

Entity PDF 0.0.0 < 2.1.5

References

https://www.drupal.org/sa-contrib-2026-114

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marcus Johansson (marcus_johansson)
Italo Mairo (itamair)
Wesley Sandra (weseze)
Swan Kalata (akalata)
Greg Knaddison (greggles)
Juraj Nemec (poker10)
Jess (xjm)
.