Server-Side Authorization Flaw in Pimcore's Admin Classic Bundle
CVE-2026-23495
4.3MEDIUM
What is CVE-2026-23495?
A security vulnerability in Pimcore's Admin Classic Bundle allows authenticated users lacking specific permissions to access the API endpoint for listing Predefined Properties. This oversight enables unauthorized retrieval of sensitive metadata configurations, which could lead to potential misuse of information within the Pimcore platform. The issue, affecting versions before 2.2.3 and 1.7.16, undermines the integrity of property management workflows, emphasizing the need for proper access controls.
Affected Version(s)
pimcore >= 2.0.0-RC1, < 2.2.3 < 2.0.0-RC1, 2.2.3
pimcore < 1.7.16 < 1.7.16