User Enumeration Vulnerability in Pimcore Backend UI

CVE-2025-24980

What is CVE-2025-24980?

The Pimcore admin-ui-classic-bundle utilizes a 'Forgot password' function that improperly discloses existing user accounts through error messages. This vulnerability can lead to user enumeration, allowing attackers to know which accounts are valid on the target system. Affected versions do not implement a generic error message to obscure the existence or non-existence of accounts. Users are urged to upgrade to version 1.7.4 or later to protect against this issue, as there are currently no available workarounds.

References