CVE-2026-23495

Katalog CVE

CVSS 4.3 · Medium EPSS 0,36%

Kerentanan Improper Access Control pada pimcore admin classic bundle. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pimcore/pimcore/security/advisories/GHSA-hqrp-m84v-2m2f exploit · advisory vendor
• https://github.com/pimcore/admin-ui-classic-bundle/commit/98095949fbeaf11cdf4cadb2989d7454e1b88909 patch
• https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.7.16 release notes
• https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v2.2.3 release notes