An unauthenticated access control flaw in PdfDing versions prior to 1.7.0 allows unauthorized retrieval of password-protected documents, posing a high risk to data confidentiality.

The application fails to properly enforce access controls, allowing unauthenticated attackers to retrieve password-protected PDFs by directly invoking the file-serving endpoint without completing the required authentication flow.

The vulnerability enables unauthorized parties to access sensitive, password-protected documents without credentials. With a CVSS score of 7.5, this high-severity flaw directly compromises the confidentiality of shared data, potentially leading to unauthorized disclosure of confidential information and regulatory compliance failures.

Immediate Action: Update the PdfDing installation to version 1.7.0 or later to implement the necessary access control checks.

Proactive Monitoring: Review web server and application access logs for repeated or suspicious requests to document-serving endpoints that bypass typical user authentication patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) to restrict access to document-serving endpoints, ensuring that requests are validated before reaching the backend application.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation for this access control bypass, administrators should prioritize updating to version 1.7.0 immediately. Failure to patch leaves sensitive, password-protected documents exposed to any user with network access to the application.