CVE-2026-23494 Details
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL patterns defined via the backend interface or the var/config/staticroutes.php file, including details like regex-based patterns, controllers, variables, and priorities. These routes are registered automatically through the PimcoreStaticRoutesBundle and integrated into the MVC routing system. Testing revealed that an authenticated backend user lacking explicit permissions was able to invoke the endpoint (e.g., GET /api/static-routes) and retrieve sensitive route configurations. This vulnerability is fixed in 12.3.1 and 11.5.14.
A vulnerability exists in Pimcore's API endpoint for managing static routes, affecting versions prior to 12.3.1 and 11.5.14. The issue arises from inadequate server-side authorization checks, allowing authenticated users without the necessary permissions to access sensitive route configurations. Static routes, which are custom URL patterns integrated into the MVC routing system, can be defined through the backend interface or a specific configuration file. The lack of proper authorization could lead to unauthorized access to internal routing metadata, potentially exposing application architecture and custom logic intended for administrative roles.
Users can upgrade to Pimcore versions 12.3.1 or 11.5.14, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf | CISA-ADP | ExploitVendor Advisory |
| https://github.com/pimcore/pimcore/pull/18893 | [email protected] | Issue Tracking |
| https://github.com/pimcore/pimcore/releases/tag/v11.5.14 | [email protected] | Release Notes |
| https://github.com/pimcore/pimcore/releases/tag/v12.3.1 | [email protected] | Release Notes |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pimcore pimcore | < 11.5.14 >= 12.0.0, < 12.3.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jan 20, 2026 | Initial Analysis | [email protected] |
| Jan 15, 2026 | CVE Modified | CISA-ADP |
| Jan 15, 2026 | New CVE Received | [email protected] |