Most recent entries from all

EUVD-2026-265833

2026-10-09T07:51:11.060299+00:00

EUVD-2026-265833

fkie_cve-2026-23495

2026-10-09T07:51:11.060337+00:00

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.

GHSA-hqrp-m84v-2m2f — Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

2026-10-09T07:51:11.060376+00:00

Affected: Packagist: pimcore/admin-ui-classic-bundle

### Summary The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. This exemplifies Broken Access Control (OWASP Top 10 A01:2021), enabling unauthorized access to administrative features and potentially violating role-based access controls inherent to Pimcore's multi-user environment.

### Details The backend user without permission was still able to list "Predefined Properties" item

### Step to Reproduce the issue login as Admin (full permission) and clicked "Predefined Properties"

Then, captured and saved the request: - List API

Next, login a backend user with no permission