CVE-2026-45704 Details
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with the reports permission to directly request an unshared report such as poc-secret-report by name and read report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings even when shareGlobally is false. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
An authorization bypass vulnerability has been identified in Pimcore's Custom Reports feature, affecting versions prior to 11.5.17 (LTS) and 12.3.6. The issue arises from inconsistent authorization checks between the report listing and detail endpoints, allowing low-privileged backend users with report permissions to access unshared reports directly by name. This vulnerability enables unauthorized users to read sensitive report metadata, including the report's name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings.
Users can update to Pimcore versions 11.5.17 (LTS) or 12.3.6 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/pimcore/pimcore/commit/1893ff1cd116e442b995ddf17e8c6e0aa372268e | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/pull/19099 | [email protected] | Source CodeVendor |
| https://github.com/pimcore/pimcore/releases/tag/v12.3.6 | [email protected] | Release NotesVendor |
| https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pimcore | <= 11.5.16 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |