PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to version 1.7.1, check_shared_access_allowed() validates only session existence — it does not check SharedPdf.inactive (expiration / max views) or SharedPdf.deleted. The Serve and Download endpoints rely solely on this function, allowing previously-authorized users to access shared PDF content after expiration, view limit, or soft-deletion. This issue has been patched in version 1.7.1.
References
| Link | Resource |
|---|---|
| https://github.com/mrmn2/PdfDing/commit/a6783b259b25c839c52c6f2380333827a52e89eb | Patch |
| https://github.com/mrmn2/PdfDing/releases/tag/v1.7.1 | Product Release Notes |
| https://github.com/mrmn2/PdfDing/security/advisories/GHSA-vfqx-2464-38wf | Exploit Mitigation Vendor Advisory |
Configurations
History
13 Apr 2026, 16:53
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/mrmn2/PdfDing/commit/a6783b259b25c839c52c6f2380333827a52e89eb - Patch | |
| References | () https://github.com/mrmn2/PdfDing/releases/tag/v1.7.1 - Product, Release Notes | |
| References | () https://github.com/mrmn2/PdfDing/security/advisories/GHSA-vfqx-2464-38wf - Exploit, Mitigation, Vendor Advisory | |
| First Time |
Pdfding
Pdfding pdfding |
|
| CPE | cpe:2.3:a:pdfding:pdfding:*:*:*:*:*:*:*:* |
31 Mar 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-31 21:16
Updated : 2026-04-13 16:53
NVD link : CVE-2026-34586
Mitre link : CVE-2026-34586
CVE.ORG link : CVE-2026-34586
JSON object : View
Products Affected
pdfding
- pdfding
CWE
CWE-863
Incorrect Authorization