PT-2026-44159 · Git+2 · Pimcore+1

CVE-2026-45704

·

Published

2026-05-27

·

Updated

2026-07-20

CVSS v4.0

7.1

High

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 11.5.17 (LTS) Pimcore versions prior to 12.3.6
Description CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint. While the listing flow filters reports based on sharing rules, the detail flow only checks for generic reports or reports config permissions. This allows a low-privileged backend user with the reports permission to bypass access controls and directly request an unshared report by name. An attacker can read sensitive report metadata, including the report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings, even when shareGlobally is set to false.
Technical details include the following:
  • API Endpoints: The getAction() function in CustomReportController.php is vulnerable, as are other report endpoints such as data, chart, create-csv, and download-csv that resolve reports by name.
  • Vulnerable Parameters or Variables: The name parameter is used to directly request report configurations.
  • Function Names: The getAction() function fails to implement the same sharing checks found in loadForGivenUser().
Recommendations Update Pimcore to version 11.5.17 (LTS). Update Pimcore to version 12.3.6.

Exploit

Fix

Missing Authorization

Incorrect Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862CWE-863

Related Identifiers

CVE-2026-45704
GHSA-JWCC-GV4M-93X6

Affected Products

Pimcore
Pimcore/Pimcore