CVE-2026-34376

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without completing the password verification flow. This results in unauthorized access to confidential documents that users expected to be protected by a shared-link password. This issue has been patched in version 1.7.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a	Patch
https://github.com/mrmn2/PdfDing/pull/294	Issue Tracking Patch
https://github.com/mrmn2/PdfDing/releases/tag/v1.7.0	Product Release Notes
https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pdfding:pdfding:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) PdfDing es un gestor, visor y editor de PDF autoalojado que ofrece una experiencia de usuario fluida en múltiples dispositivos. Antes de la versión 1.7.0, una vulnerabilidad de control de acceso permite a usuarios no autenticados recuperar PDF compartidos protegidos con contraseña al llamar directamente al endpoint de servicio de archivos sin completar el flujo de verificación de contraseña. Esto resulta en acceso no autorizado a documentos confidenciales que los usuarios esperaban que estuvieran protegidos por una contraseña de enlace compartido. Este problema ha sido parcheado en la versión 1.7.0.

Information

Published : 2026-04-01 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34376

Mitre link : CVE-2026-34376

CVE.ORG link : CVE-2026-34376

JSON object : View

Products Affected

pdfding

pdfding

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-34376", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34376", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-01T18:53:03.522879Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mrmn2", "product": "PdfDing", "versions": [{"status": "affected", "version": "< 1.7.0"}]}]}], "published": "2026-04-01T18:16:30.177", "references": [{"url": "https://github.com/mrmn2/PdfDing/commit/ae579ea98c5603d1435e0d90e81d72151564088a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrmn2/PdfDing/pull/294", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrmn2/PdfDing/releases/tag/v1.7.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mrmn2/PdfDing/security/advisories/GHSA-42x7-vvj4-4cj3", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.0, an access-control vulnerability allows unauthenticated users to retrieve password-protected shared PDFs by directly calling the file-serving endpoint without completing the password verification flow. This results in unauthorized access to confidential documents that users expected to be protected by a shared-link password. This issue has been patched in version 1.7.0."}, {"lang": "es", "value": "PdfDing es un gestor, visor y editor de PDF autoalojado que ofrece una experiencia de usuario fluida en m\u00faltiples dispositivos. Antes de la versi\u00f3n 1.7.0, una vulnerabilidad de control de acceso permite a usuarios no autenticados recuperar PDF compartidos protegidos con contrase\u00f1a al llamar directamente al endpoint de servicio de archivos sin completar el flujo de verificaci\u00f3n de contrase\u00f1a. Esto resulta en acceso no autorizado a documentos confidenciales que los usuarios esperaban que estuvieran protegidos por una contrase\u00f1a de enlace compartido. Este problema ha sido parcheado en la versi\u00f3n 1.7.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pdfding:pdfding:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B5F1011-6A2F-4DB7-8192-662436A9918D", "versionEndExcluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}