Stirling-PDF is a locally hosted web application for PDF operations. Before version 2.9.0, the /api/v1/pipeline/handleData endpoint injects the internal API key into subrequests, which authenticated users with ROLE_USER can retrieve through /api/v1/user/get-api-key. This enables them to impersonate the internal service account, bypass normal rate limits, and access sensitive internal endpoints such as /api/v1/info/requests/all and /api/v1/info/load/all. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials).

An authenticated user with ROLE_USER privileges can obtain the internal backend API key, allowing impersonation of the internal service account. This leads to bypassing rate limits and unauthorized access to internal endpoints, potentially exposing sensitive information. The CVSS 3.1 score is 8.5 (High), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, high confidentiality impact, low integrity impact, and no availability impact.

This vulnerability is fixed in Stirling-PDF version 2.9.0. Users should upgrade to version 2.9.0 or later to remediate this issue. Since the product is locally hosted and no vendor advisory is provided, patch status is confirmed by the version fix statement in the description. No additional mitigation is indicated.