CVE-2026-108697 Overview
CVE-2026-108697 is a missing authorization vulnerability [CWE-862] in CoreShop through version 2026.2.2. The ResourceController::listAction method skips the isGrantedOr403() permission check, exposing resource list endpoints to any authenticated Pimcore backend user. Low-privileged users lacking resource permissions can enumerate payment providers, carriers, price rules, stores, and tax rules through the generated list routes. Each response discloses internal identifiers, names, and metadata that should remain restricted to authorized administrators.
Critical Impact
Authenticated low-privileged users can enumerate sensitive e-commerce configuration data including payment providers, carriers, price rules, stores, and tax rules.
Affected Products
- CoreShop through 2026.2.2
- CoreShop ResourceBundle ResourceController
- Pimcore installations integrating CoreShop backend modules
Discovery Timeline
- 2026-10-11 - CVE-2026-108697 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-108697
Vulnerability Analysis
The flaw resides in the listAction method of the ResourceController class in CoreShop's ResourceBundle. This controller supplies the backing logic for list routes across multiple CoreShop entities. Unlike other controller actions that invoke isGrantedOr403() to verify the caller holds the required resource permission, listAction omits the check entirely.
As a result, any authenticated Pimcore backend user can issue list requests that return structured JSON payloads containing resource identifiers, names, and other metadata. The affected resources include payment providers, carriers, price rules, stores, and tax rules. The disclosed data supports reconnaissance of the shop's commerce configuration and enables targeted follow-on attacks against identified payment integrations or pricing logic.
See the CoreShop ResourceController code snippet for the vulnerable implementation.
Root Cause
The root cause is a missing authorization check [CWE-862] in a shared controller action. The listAction method should mirror the permission enforcement pattern used elsewhere in the bundle by calling isGrantedOr403() with the resource's permission string. Because the check is absent, Symfony's firewall only validates that the request is authenticated, not that the caller holds the resource-specific grant.
Attack Vector
An attacker needs valid, low-privileged Pimcore backend credentials. The attacker sends authenticated HTTP GET requests to the generated list endpoints that back CoreShop administration views, such as payment provider or carrier listings. The server returns the full resource list regardless of the caller's permission grants.
No synthetic exploit code is reproduced here. Refer to the VulnCheck advisory and the CoreShop PaymentProviderController source for the affected route definitions.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-108697
Indicators of Compromise
- Authenticated requests to CoreShop list routes originating from accounts without matching resource permissions.
- Repeated enumeration patterns across payment-providers, carriers, price-rules, stores, and tax-rules endpoints.
- HTTP 200 responses to list routes for user sessions that have never accessed the corresponding administration UI.
Detection Strategies
- Correlate Pimcore user role assignments against web server access logs to flag list-route hits from accounts missing the relevant permission.
- Add application-level logging to ResourceController::listAction to record caller identity, requested resource, and granted permissions.
- Hunt for anomalous volumes of list requests from a single backend session within short time windows.
Monitoring Recommendations
- Forward Pimcore and web server access logs to a centralized analytics platform for review against role-based access baselines.
- Alert on backend accounts that query resource list endpoints they have no business role to use.
- Monitor for new or seldom-used backend accounts that begin enumerating commerce configuration resources.
How to Mitigate CVE-2026-108697
Immediate Actions Required
- Restrict backend access to trusted administrators and review the role assignments of all existing Pimcore users.
- Audit CoreShop list routes exposed by the ResourceBundle and remove unnecessary access to the Pimcore backend from untrusted networks.
- Rotate credentials for low-privileged backend accounts suspected of enumerating restricted resources.
Patch Information
At the time of publication, CoreShop versions through 2026.2.2 are affected, and no fixed version is listed in the NVD record. Monitor the CoreShop GitHub repository and the VulnCheck advisory for an official patched release. The remediation requires reintroducing the isGrantedOr403() permission check inside ResourceController::listAction.
Workarounds
- Override ResourceController::listAction in a project-specific subclass that invokes isGrantedOr403() with the appropriate resource permission before returning data.
- Place the Pimcore admin interface behind a VPN or IP allowlist to limit which users can reach the affected endpoints.
- Temporarily reduce the number of accounts granted any Pimcore backend access until a patched release is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
