https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T23:54:49.108236+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-198499 EUVD-2026-198499 2026-10-06T23:54:49.110577+00:00 EUVD-2026-198499 https://cve.radiocsirt.org/vuln/fkie_cve-2023-3574 fkie_cve-2023-3574 2026-10-06T23:54:49.110610+00:00

Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.

 https://cve.radiocsirt.org/vuln/ghsa-vx35-f379-4q49 GHSA-vx35-f379-4q49 — Pimcore Customer Management Framework vulnerable to Improper Authorization in Rules Controller 2026-10-06T23:54:49.110639+00:00

Affected: Packagist: pimcore/customer-management-framework-bundle

### Impact The product performs authorization checks incorrectly when an unauthorized actor tries to access a resource or perform an actions.

The attacker can view and freely perform actions to add, modify, or delete rules.

### Patches Update to version 3.4.1 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch

### Workarounds Apply https://github.com/pimcore/customer-data-framework/commit/f15668c86db254e86ba7ac895bc3cdd1a2a3cc45.patch manually.

### References https://huntr.dev/bounties/1dcb4f01-e668-4aa3-a6a3-838532e500c6/

 https://cve.radiocsirt.org/vuln/gsd-2023-3574 gsd-2023-3574 2026-10-06T23:54:49.110668+00:00 gsd-2023-3574