The flaw resides in the function that checks whether a user may access a shared PDF. It verifies only that a session exists, neglecting to verify whether the shared PDF has expired, reached its maximum view count, or has been softly deleted. Because of this oversight the system will continue to grant access through the Serve and Download endpoints to any previously authorized user, even after the PDF should no longer be reachable. This fails proper authorization enforcement and can lead to accidental disclosure of content that was intended to be removed.

The affected software is PdfDing, a self‑hosted PDF manager developed by mrmn2. Any installation running a version earlier than 1.7.1 is vulnerable, as those releases lack the necessary checks for inactive, exhausted, or deleted shared PDFs.

The base CVSS score of 6.5 indicates a moderate severity vulnerability, while the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is low. The flaw has not been recorded in the CISA Known Exploited Vulnerabilities list. Attackers can exploit the vulnerability simply by using a valid session to hit the Serve or Download endpoints for a PDF that has expired, exceeded its view limits, or has been marked as deleted. No elevated privileges are required, and the exploitation path is straightforward once the endpoint is reachable.