CVE-2026-55207

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 2025.4.6 Pimcore versions prior to 2026.1.6

Description An unauthenticated attacker who knows a valid admin username can take over an admin account by sending a password reset request containing an attacker-controlled resetPasswordUrl. The server generates a cryptographic recovery token, appends it to the provided URL, and emails the link to the victim. If the victim clicks the link, the token is sent to the attacker, who can then use it via the 'POST /pimcore-studio/api/login/token' endpoint to authenticate with full admin privileges and bypass two-factor authentication.

Recommendations Update to version 2025.4.6. Update to version 2026.1.6.