Server-Side Authorization Flaw in Pimcore Web2Print Tools Bundle
CVE-2026-23496

5.4MEDIUM

Key Information:

Vendor

Pimcore
Status
Pimcore
Vendor
CVE Published:
15 January 2026

What is CVE-2026-23496?

The Pimcore Web2Print Tools Bundle, which provides tools for web-to-print scenarios, has a server-side authorization bypass issue. In versions prior to 5.2.2 and 6.1.1, the application does not properly enforce authorization checks on the API endpoint managing 'Favourite Output Channel Configurations'. This flaw allows authenticated backend users to access and modify these configurations without the required permissions, exposing potential data integrity concerns. The vulnerability has been resolved in subsequent updates.

Affected Version(s)

pimcore >= 6.0.0-RC1, < 6.1.1 < 6.0.0-RC1, 6.1.1

pimcore < 5.2.2 < 5.2.2

References

https://github.com/pimcore/pimcore/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/pimcore/web2print-tools/pull/108
x_refsource_MISC
https://github.com/pimcore/web2print-tools/commit/7714452...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.