PT-2026-44159

CVE-2026-45704

Published

2026-05-27

Updated

2026-07-20

Description by

CVSS 4.0

7.1

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.17 (LTS) Pimcore versions prior to 12.3.6

Description CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint. While the listing flow filters reports based on sharing rules, the detail flow only checks for generic reports or reports config permissions. This allows a low-privileged backend user with the reports permission to bypass access controls and directly request an unshared report by name. An attacker can read sensitive report metadata, including the report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings, even when shareGlobally is set to false.

Technical details include the following:

API Endpoints: The getAction() function in CustomReportController.php is vulnerable, as are other report endpoints such as data, chart, create-csv, and download-csv that resolve reports by name.
Vulnerable Parameters or Variables: The name parameter is used to directly request report configurations.
Function Names: The getAction() function fails to implement the same sharing checks found in loadForGivenUser().