CVE-2026-81164 Overview
CVE-2026-81164 is a Missing Authorization vulnerability [CWE-862] in the Drupal Entity PDF contributed module. The flaw allows Forceful Browsing, letting authenticated users with low privileges access resources that should be restricted by authorization checks. All versions of Entity PDF from 0.0.0 through 2.1.5 are affected. The issue impacts both confidentiality and integrity at a limited scope, but does not affect availability. Attackers exploit the vulnerability remotely over the network with low privileges and no user interaction.
Critical Impact
Authenticated attackers can bypass authorization controls in the Entity PDF module to view or modify PDF-rendered entity content they should not be able to reach.
Affected Products
- Drupal Entity PDF module versions 0.0.0 through 2.1.5
- Drupal sites using Entity PDF to render entities as PDF documents
- Deployments allowing authenticated user registration or low-privilege accounts
Discovery Timeline
- 2026-09-02 - CVE-2026-81164 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-81164
Vulnerability Analysis
The Entity PDF module generates PDF renderings of Drupal entities such as nodes, users, or taxonomy terms. The vulnerability stems from missing authorization enforcement on routes or controllers that serve these PDF outputs. An authenticated user submits a request against a predictable resource path and receives content that access control rules would normally block.
Forceful Browsing means the attacker does not need to defeat authentication or perform injection. The attacker enumerates or guesses entity identifiers and requests the PDF endpoint directly. The module fails to verify that the requesting account has the required permission on the underlying entity before returning the rendered file.
Because both confidentiality and integrity carry a low impact rating, the exposed operations extend beyond read-only viewing. See the Drupal Security Advisory for the vendor's technical description.
Root Cause
The root cause is a missing access check [CWE-862] in the Entity PDF request-handling code path. The module trusts the requesting session without evaluating the entity-level permission or the Drupal access API result before rendering and returning the PDF document.
Attack Vector
Exploitation requires network access to the Drupal site and a valid authenticated account with low privileges. The attacker crafts a direct request to an Entity PDF route, referencing an entity identifier they were not granted access to. The server returns the PDF representation, disclosing or allowing modification of the target entity's data. No specialized tooling, user interaction, or elevated role is required.
No public proof-of-concept or exploit code is available at the time of publication. Refer to the Drupal Security Advisory for authoritative details.
Detection Methods for CVE-2026-81164
Indicators of Compromise
- Web server access logs showing authenticated requests to Entity PDF routes referencing entity IDs the requesting user does not own or have permission to view.
- Sequential or enumerated entity ID patterns in Entity PDF endpoint requests from a single session.
- Unexpected PDF download activity from low-privilege accounts against internal or restricted content types.
Detection Strategies
- Correlate Entity PDF route access with Drupal user permission mappings to identify requests inconsistent with granted roles.
- Alert on high-volume PDF endpoint requests from a single authenticated session, which suggests entity ID enumeration.
- Review Drupal watchdog logs for repeated access to Entity PDF controllers followed by successful HTTP 200 responses to non-privileged users.
Monitoring Recommendations
- Ingest Drupal application logs and reverse-proxy access logs into a centralized analytics platform for long-term correlation.
- Baseline normal PDF export volume per user role and generate alerts on statistical deviations.
- Track newly registered accounts that immediately access Entity PDF routes, a pattern consistent with abuse of Forceful Browsing.
How to Mitigate CVE-2026-81164
Immediate Actions Required
- Upgrade the Drupal Entity PDF module to the fixed release published in the Drupal Security Advisory.
- Audit existing Drupal user accounts and revoke unused or unnecessary authenticated accounts that could be leveraged for Forceful Browsing.
- Review Entity PDF route access logs for retroactive evidence of unauthorized entity access.
Patch Information
Drupal published a fixed release for the Entity PDF module addressing versions 0.0.0 through 2.1.5. Administrators should install the fixed version referenced in the vendor advisory and clear Drupal's route and permission caches after upgrade. See the Drupal Security Advisory for the exact patched version.
Workarounds
- Temporarily disable the Entity PDF module until the patched release is applied if PDF export is non-essential.
- Restrict access to Entity PDF routes at the reverse proxy or web application firewall layer to trusted roles only.
- Disable open user registration to reduce the population of authenticated accounts capable of exploiting the flaw.
# Example: disable the Entity PDF module using Drush until a patch is applied
drush pm:uninstall entity_pdf
drush cache:rebuild
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
