https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T20:56:37.797588+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-10170 EUVD-2026-10170 2026-10-05T20:56:37.857767+00:00 EUVD-2026-10170 https://cve.radiocsirt.org/vuln/fkie_cve-2023-49075 fkie_cve-2023-49075 2026-10-05T20:56:37.857802+00:00

The Admin Classic Bundle provides a Backend UI for Pimcore. `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls. An authenticated user can access the system without having to provide the two factor credentials. This issue has been patched in version 1.2.2.

 https://cve.radiocsirt.org/vuln/ghsa-9wwg-r3c7-4vfg GHSA-9wwg-r3c7-4vfg — Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls 2026-10-05T20:56:37.857836+00:00

Affected: Packagist: pimcore/admin-ui-classic-bundle

### Impact `AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls.

An authenticated user can access the system without having to provide the 2 factor credentials.

### Patches Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch

### Workarounds Upgrade to version 1.2.2 or apply the [patch](https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch) manually.

 https://cve.radiocsirt.org/vuln/gsd-2023-49075 gsd-2023-49075 2026-10-05T20:56:37.857867+00:00 gsd-2023-49075