CVE-2026-55212

Name of the Vulnerable Software and Affected Versions Pimcore versions prior to 2025.4.6 Pimcore versions prior to 2026.1.6

Description The Studio API class definition creation endpoint 'POST /pimcore-studio/api/class/definition/configuration-view/detail/create' is guarded by the objects permission instead of the classes permission. This allows a standard editor-level user to create class definitions without admin privileges, which results in the generation of new database tables and PHP class files on the server. Additionally, missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions.

Recommendations Update to version 2025.4.6. Update to version 2026.1.6.