PT-2026-3078 · Pimcore · Pimcore Web2Print Tools Bundle

Ytlamal · Published 2026-01-15 · Updated 2026-01-15 · CVE-2026-23496

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pimcore Web2Print Tools Bundle versions prior to 5.2.2 Pimcore Web2Print Tools Bundle versions prior to 6.1.1

Description The Pimcore Web2Print Tools Bundle does not properly enforce server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." An authenticated backend user lacking the necessary permissions can invoke the endpoint to modify or retrieve these configurations. The vulnerable API endpoint is responsible for managing "Favourite Output Channel Configurations."

Recommendations Update to Pimcore Web2Print Tools Bundle version 5.2.2 or later. Update to Pimcore Web2Print Tools Bundle version 6.1.1 or later.

Exploit

Fix

Incorrect Authorization

Improper Access Control

Weakness Enumeration

CWE-863

CWE-284

Related Identifiers

CVE-2026-23496

GHSA-4WG4-P27P-5Q2R

Affected Products

Pimcore Web2Print Tools Bundle

References · 11

• 🔥 https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23496.json · Exploit
• 🔥 https://github.com/pimcore/web2print-tools/pull/108 · Exploit
• https://github.com/pimcore/web2print-tools/commit/7714452a04b9f9b077752784af4b8d0b05e464a1 · Patch
• https://osv.dev/vulnerability/CVE-2026-23496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23496 · Security Note
• https://osv.dev/vulnerability/GHSA-4wg4-p27p-5q2r · Vendor Advisory
• https://github.com/pimcore/pimcore · Note
• https://github.com/pimcore/web2print-tools/releases/tag/v6.1.1 · Note
• https://github.com/pimcore/web2print-tools/releases/tag/v5.2.2 · Note
• https://twitter.com/CVEnew/status/2011926075509784906 · Twitter Post