PdfDing, a self-hosted PDF manager, has an access‑control flaw (CWE‑863) that lets an unauthenticated user retrieve password‑protected shared PDFs by calling the file‑serving endpoint directly. Because the password verification step is bypassed, the attacker can view confidential documents that were intended to be protected. The vulnerability permits unauthorized access to sensitive information.

The flaw affects installations of PdfDing from the vendor mrmn2. Any deployment running a version older than 1.7.0 is vulnerable. The issue was fixed in version 1.7.0 and later releases.

The CVSS score of 7.5 indicates high severity. The EPSS score is below 1 %, suggesting low current exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it by sending an unauthenticated HTTP request to the file‑serving endpoint, triggering the return of the protected PDF without a password prompt.