SA-CONTRIB-2026-114: Critical severity drupal/entity_pdf vulnerability
The Entity PDF module can create a PDF from any entity based on any View mode. This module does not check entity view access when fetching a PDF route. This could result in a user accessing a PDF of an entity that they should not be able to view.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/entity_pdfto a version that resolves this vulnerability.Fixed in 2.1.5
Event History
Frequently Asked Questions
Who can exploit this issue?
Any user who can request an Entity PDF route may be able to obtain a PDF for an entity they are not authorized to view, because entity view access is not checked when the PDF route fetches the entity.
Does the selected View mode prevent unauthorized disclosure?
No. The module can create a PDF from any entity using any View mode, but the PDF route does not enforce entity view access.
How can I determine whether information may already have been exposed?
Review requests to Entity PDF routes and identify PDFs generated for entities where the requesting user lacked normal entity view permission. Compare PDF-route requests with the entity's access controls and the requesting user's permissions.