https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 04:01:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265833 EUVD-2026-265833 https://cve.radiocsirt.org/vuln/euvd-2026-265833 https://cve.radiocsirt.org/vuln/fkie_cve-2026-23495 <p>Pimcore&#39;s Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore&#39;s official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.</p> <p>Pimcore&#39;s Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore&#39;s official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-23495 https://cve.radiocsirt.org/vuln/ghsa-hqrp-m84v-2m2f <p><strong>Affected:</strong> Packagist: pimcore/admin-ui-classic-bundle</p> <p>### Summary The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore&#39;s official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. This exemplifies Broken Access Control (OWASP Top 10 A01:2021), enabling unauthorized access to administrative features and potentially violating role-based access controls inherent to Pimcore&#39;s multi-user environment.</p> <p>### Details The backend user without permission was still able to list &#34;Predefined Properties&#34; item</p> <p>### Step to Reproduce the issue login as Admin (full permission) and clicked &#34;Predefined Properties&#34; &lt;img width=&#34;1493&#34; height=&#34;862&#34; alt=&#34;Screenshot 2025-12-10 at 10 11 31 PM&#34; src=&#34;https://github.com/user-attachments/assets/005d2704-347c-4aa1-b415-d52ab3794c99&#34; /&gt;</p> <p>Then, captured and saved the request: - List API &lt;img width=&#34;922&#34; height=&#34;797&#34; alt=&#34;Screenshot 2025-12-10 at 10 39 53 PM&#34; src=&#34;https://github.com/user-attachments/assets/2ee3e0e1-06da-442f-b2c7-0dfa8360c04a&#34; /&gt;</p> <p>Next, login a backend user with no permission &lt;img width=&#34;1219&#34; height=&#34;744&#34; alt=&#34;Screenshot 2025-12-1…</p> <p><strong>Affected:</strong> Packagist: pimcore/admin-ui-classic-bundle</p> <p>### Summary The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore&#39;s official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. This exemplifies Broken Access Control (OWASP Top 10 A01:2021), enabling unauthorized access to administrative features and potentially violating role-based access controls inherent to Pimcore&#39;s multi-user environment.</p> <p>### Details The backend user without permission was still able to list &#34;Predefined Properties&#34; item</p> <p>### Step to Reproduce the issue login as Admin (full permission) and clicked &#34;Predefined Properties&#34; &lt;img width=&#34;1493&#34; height=&#34;862&#34; alt=&#34;Screenshot 2025-12-10 at 10 11 31 PM&#34; src=&#34;https://github.com/user-attachments/assets/005d2704-347c-4aa1-b415-d52ab3794c99&#34; /&gt;</p> <p>Then, captured and saved the request: - List API &lt;img width=&#34;922&#34; height=&#34;797&#34; alt=&#34;Screenshot 2025-12-10 at 10 39 53 PM&#34; src=&#34;https://github.com/user-attachments/assets/2ee3e0e1-06da-442f-b2c7-0dfa8360c04a&#34; /&gt;</p> <p>Next, login a backend user with no permission &lt;img width=&#34;1219&#34; height=&#34;744&#34; alt=&#34;Screenshot 2025-12-1…</p> https://cve.radiocsirt.org/vuln/ghsa-hqrp-m84v-2m2f