CVE-2026-23495 - Pimcore Plugin
CVE-2026-23495
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.
CVE-2026-23495
MEDIUM
CVSS 4.3
Published 2026-01-15
Updated 2026-01-30
AI Risk Moderate (48/100)
Active Exploit: No strong signal
Published Exploit: Public exploit references found
Priority: P4 Planned
Severity Band
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected Components
1
Reference Links
4
AI Risk Engine
Moderate (48/100)
Exploitability
Medium
Active Exploitation
No strong signal
Published Exploit Status
Public exploit references found
AI Context
Machine-generated threat intelligence
AI
Updated 12 days ago
AI enriched 12 days ago (2026-04-09 08:02 UTC)
Technical Summary
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call…
Potential Impact
Severity is MEDIUM (CVSS 4.3). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.
Exploitability Assessment
Exploitability is assessed as Medium based on published exploit references.
Primary risk drivers: published exploit references
Mitigation Recommendations
Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.
Detection & Monitoring
Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.
Business Impact Lens
Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.
