User Enumeration Vulnerability in Pimcore Backend UI

CVE-2025-24980

What is CVE-2025-24980?

The Pimcore admin-ui-classic-bundle utilizes a 'Forgot password' function that improperly discloses existing user accounts through error messages. This vulnerability can lead to user enumeration, allowing attackers to know which accounts are valid on the target system. Affected versions do not implement a generic error message to obscure the existence or non-existence of accounts. Users are urged to upgrade to version 1.7.4 or later to protect against this issue, as there are currently no available workarounds.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References