CVE-2026-45703 Details
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
An authorization bypass vulnerability has been identified in Pimcore's WordExport feature, present in versions prior to 11.5.17 (LTS) and 12.3.7. The issue arises in the WordExport export flow, specifically within the TranslationController of the WordExportBundle. The vulnerability allows low-privileged backend users to export document content they are not authorized to view. This is achieved by exploiting the export flow, which only checks for the word_export feature permission, without enforcing view permissions on the actual content elements, such as pages, snippets, emails, or objects.
Users should update to Pimcore versions 11.5.17 (LTS) or 12.3.7, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/security/advisories/GHSA-332x-r494-54fq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pimcore/pimcore/releases/tag/v12.3.7 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-332x-r494-54fq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pimcore | <= 11.5.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |