PT-2026-3075 · Pimcore · Pimcore

Ytlamal

·

Published

2026-01-15

·

Updated

2026-01-15

·

CVE-2026-23495

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 2.2.3 and versions prior to 1.7.16
Description The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions used across documents, assets, and objects to standardize custom attributes. An authenticated backend user without explicit permissions for property management can call the endpoint and retrieve the complete list of these configurations. This allows unauthorized access to administrative features and potentially violates role-based access controls. The API endpoint in question is used for listing Predefined Properties.
Recommendations Versions prior to 2.2.3 should be updated to version 2.2.3 or later. Versions prior to 1.7.16 should be updated to version 1.7.16 or later.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-23495
GHSA-HQRP-M84V-2M2F

Affected Products

Pimcore