CVE-2026-23495: Pimcore Admin Classic Bundle Lacks Function Level Authorization on Predefined Properties Listing
Summary
CVE-2026-23495: The API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Affects pimcore/admin-ui-classic-bundle across 2 version ranges.
< 1.7.16
>= 2.0.0-RC1, < 2.2.3
Fixed in 1.7.16 or 2.2.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pimcore is an open-source digital experience platform that provides a comprehensive solution for managing digital assets, products, and content. The Admin Classic Bundle is a key component of Pimcore, enabling users to manage predefined properties that standardize custom attributes across various entities. This bundle is essential for maintaining consistency and improving editorial workflows within the Pimcore environment. However, it has been found to have a significant vulnerability related to access control.
Vulnerability Detail
The vulnerability arises from the absence of adequate server-side authorization checks in the API endpoint responsible for listing Predefined Properties. This flaw allows authenticated backend users, even those without explicit permissions for property management, to access and retrieve the complete list of these configurations. This represents a case of Broken Access Control, as defined by OWASP Top 10 A01:2021. The implications of this vulnerability are severe, as it can lead to unauthorized access to sensitive metadata, potentially exposing internal business logic and data classification strategies.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.7.161.7.16composer require pimcore/admin-ui-classic-bundle:1.7.16 -
>= 2.0.0-RC1, < 2.2.32.2.3composer require pimcore/admin-ui-classic-bundle:2.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, organizations can restrict access to the API endpoint for listing Predefined Properties by implementing additional server-side checks or modifying user roles to limit access until the package is updated.
Conclusion
The CVE-2026-23495 vulnerability in the Pimcore Admin Classic Bundle highlights a critical issue related to access control that can expose sensitive information to unauthorized users. It is essential for users to update their installations to the patched versions to safeguard against potential exploitation.
See every vulnerability recorded for pimcore/admin-ui-classic-bundle →
FAQ
CVE-2026-23495 is a vulnerability in the Pimcore Admin Classic Bundle that allows unauthorized users to access the list of Predefined Properties due to missing function-level authorization.
This vulnerability can expose sensitive metadata and internal configurations to low-privileged users, potentially leading to data manipulation or privilege escalation.
If you are using an affected version of the Pimcore Admin Classic Bundle, you should update to the latest patched version as soon as possible to mitigate the risk.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software. You can check your application for vulnerabilities using the Vulert playground without any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for pimcore/admin-ui-classic-bundle.
