CVE-2026-34586: PdfDing Authorization Bypass Vulnerability

CVE-2026-34586 Overview

CVE-2026-34586 is an authorization bypass vulnerability in PdfDing, a self-hosted PDF manager, viewer, and editor designed to provide a seamless user experience across multiple devices. The vulnerability exists in the check_shared_access_allowed() function, which only validates session existence without checking critical access control flags such as SharedPdf.inactive (expiration/max views) or SharedPdf.deleted. This flaw allows previously-authorized users to continue accessing shared PDF content after expiration, view limit enforcement, or soft-deletion of the shared resource.

Critical Impact

Authenticated users with prior session access can bypass expiration, view limits, and deletion controls to access shared PDF documents they should no longer have permission to view, potentially exposing sensitive document content.

Affected Products

• PdfDing versions prior to 1.7.1

Discovery Timeline

• 2026-03-31 - CVE CVE-2026-34586 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34586

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Incorrect Authorization). The core issue lies in the incomplete access control validation within PdfDing's shared PDF serving mechanism. When a user attempts to access a shared PDF through the Serve or Download endpoints, the application validates that a session exists but fails to verify whether the shared PDF has been marked as inactive (due to expiration or maximum view count exceeded) or has been soft-deleted by the owner.

The attack requires network access and low-level privileges (an existing authenticated session). No user interaction is required for exploitation. The vulnerability results in high confidentiality impact as it allows unauthorized access to document content, though it does not affect integrity or availability of the system.

Root Cause

The root cause is an incomplete authorization check in the check_shared_access_allowed() function located in pdfding/pdf/services/shared_pdf_services.py. The function validates only that a valid session exists for the shared PDF but does not verify the SharedPdf.inactive or SharedPdf.deleted attributes before granting access. This allows the Serve and Download endpoints to serve PDF content to users who should no longer have access based on sharing policy expiration.

Attack Vector

An attacker who has previously been granted access to a shared PDF (and thus has a valid session) can continue to access the document through the Serve and Download endpoints even after:

1. The sharing link has expired
2. The maximum view count has been exceeded
3. The shared PDF has been soft-deleted by the owner

The attacker simply needs to make HTTP requests to the vulnerable endpoints using their existing session credentials.

# Vulnerable code (before patch) in pdfding/pdf/services/shared_pdf_services.py
def check_shared_access_allowed(shared_pdf: SharedPdf, session: Session):
    """Check if access to shared pdf is allowed based on session."""
    # Missing checks for shared_pdf.inactive and shared_pdf.deleted
    if (
        session
        # ... session validation only

Source: GitHub Commit Update

# Patched code in pdfding/pdf/services/shared_pdf_services.py
def check_shared_access_allowed(shared_pdf: SharedPdf, session: Session):
    if shared_pdf.inactive or shared_pdf.deleted:
        return False

    if (
        session
        # ... continues with session validation

Source: GitHub Commit Update

Detection Methods for CVE-2026-34586

Indicators of Compromise

• Unusual access patterns to shared PDF endpoints from sessions associated with expired or deleted shares
• HTTP requests to /serve/ or /download/ endpoints for shared PDFs that have been marked inactive or deleted in the database
• Access logs showing successful document retrievals for shares that should have been revoked

Detection Strategies

• Monitor application logs for access to shared PDF resources where the corresponding SharedPdf record has inactive=True or deleted=True
• Implement database query logging to identify queries that retrieve shared PDF content without checking inactive/deleted status
• Review web server access logs for repeated requests to shared PDF URLs after the sharing period should have ended

Monitoring Recommendations

• Enable detailed access logging for all shared PDF endpoints (Serve and Download)
• Set up alerts for access attempts to soft-deleted shared PDFs
• Implement audit logging that captures the state of SharedPdf.inactive and SharedPdf.deleted flags at access time
• Correlate session timestamps with share expiration times to identify anomalous access patterns

How to Mitigate CVE-2026-34586

Immediate Actions Required

• Upgrade PdfDing to version 1.7.1 or later immediately
• Review access logs to identify any potential unauthorized access to expired or deleted shared PDFs
• Invalidate all active sessions for shared PDFs that have been previously expired or deleted
• Audit shared PDF configurations to ensure sensitive documents have not been accessed after intended expiration

Patch Information

The vulnerability has been patched in PdfDing version 1.7.1. The fix adds proper authorization checks for SharedPdf.inactive and SharedPdf.deleted attributes before granting access through the Serve and Download endpoints. The patch is available through the GitHub Release v1.7.1. Additional details can be found in the GitHub Security Advisory GHSA-vfqx-2464-38wf.

Workarounds

• If immediate upgrade is not possible, manually modify the check_shared_access_allowed() function to include checks for shared_pdf.inactive and shared_pdf.deleted as shown in the patch
• Implement additional access control at the reverse proxy or web server level to restrict access to shared PDF endpoints
• Temporarily disable sharing functionality until the patch can be applied
• Review and manually purge all expired or deleted shared PDF sessions from the database

# Configuration example - Upgrade PdfDing to patched version
# Pull the latest patched release
git fetch --tags
git checkout v1.7.1

# Alternatively, if using Docker
docker pull mrmn2/pdfding:1.7.1
docker-compose up -d