CVE-2026-23495: Pimcore Auth Bypass Vulnerability

CVE-2026-23495 Overview

CVE-2026-23495 is an authorization bypass vulnerability in Pimcore's Admin Classic Bundle, which provides the Backend UI for Pimcore content management platform. Prior to versions 2.2.3 and 1.7.16, the API endpoint responsible for listing Predefined Properties lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows.

Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations, potentially exposing sensitive metadata configurations.

Critical Impact

Authenticated users without proper permissions can access the Predefined Properties API endpoint, leading to unauthorized information disclosure of metadata configurations used across documents, assets, and objects within the Pimcore platform.

Affected Products

• Pimcore Admin Classic Bundle versions prior to 2.2.3
• Pimcore Admin Classic Bundle versions prior to 1.7.16
• Pimcore platforms utilizing the Admin Classic Bundle Backend UI

Discovery Timeline

• 2026-01-15 - CVE CVE-2026-23495 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2026-23495

Vulnerability Analysis

This vulnerability falls under CWE-284 (Improper Access Control), a category of flaws where the application fails to properly restrict access to resources or functionality. In this case, the propertiesAction method in SettingsController.php did not enforce permission checks for read operations on Predefined Properties.

The core issue is that the authorization check for predefined_properties permission was only enforced when modifying data (when the request contained data parameters), but not when simply retrieving the property list. This allowed any authenticated backend user to enumerate and view all Predefined Property configurations regardless of their assigned permissions.

Root Cause

The root cause lies in the improper placement of the permission check within the propertiesAction method. The $this->checkPermission('predefined_properties') call was placed inside a conditional block that only executed when the request included data parameters for modification operations. Read-only requests to list properties bypassed this authorization gate entirely.

Attack Vector

An attacker with valid but low-privilege credentials to the Pimcore backend can exploit this vulnerability over the network. The attack requires no user interaction and can be performed by simply calling the Predefined Properties API endpoint. The attacker gains unauthorized read access to property configurations, which may reveal sensitive metadata structures, default values, and organizational data models used throughout the content management system.

// Vulnerable code - permission check only triggered on data modification
public function propertiesAction(Request $request): JsonResponse
{
    if ($request->get('data')) {
        $this->checkPermission('predefined_properties');
        // ... modification logic
    }
    // Read operations had no permission check
}

// Fixed code - permission check enforced for all operations
public function propertiesAction(Request $request): JsonResponse
{
    $this->checkPermission('predefined_properties');
    
    if ($request->get('data')) {
        // ... modification logic
    }
}

Source: GitHub Commit Update

Detection Methods for CVE-2026-23495

Indicators of Compromise

• Unusual API calls to the Predefined Properties endpoint from user accounts that lack predefined_properties permission
• Access logs showing authenticated users accessing /admin/settings/properties endpoint without corresponding administrative roles
• Anomalous patterns of metadata enumeration activities from backend user accounts

Detection Strategies

• Implement audit logging for all Predefined Properties API endpoint access and correlate with user permission assignments
• Monitor for authenticated sessions making requests to settings controller endpoints without matching administrative privileges
• Deploy application-layer detection rules to flag unauthorized access attempts to property management functions

Monitoring Recommendations

• Enable verbose logging on the Pimcore Admin Classic Bundle to capture all API requests to settings endpoints
• Configure alerts for any access to the propertiesAction endpoint from users without predefined_properties permission
• Periodically review access logs for the /admin/settings/properties endpoint to identify potential exploitation attempts

How to Mitigate CVE-2026-23495

Immediate Actions Required

• Upgrade Pimcore Admin Classic Bundle to version 2.2.3 or 1.7.16 immediately
• Review user accounts and ensure the principle of least privilege is applied to backend access
• Audit access logs for any historical unauthorized access to the Predefined Properties endpoint
• Verify all authenticated backend users have appropriate permission assignments

Patch Information

The vulnerability is fixed in Pimcore Admin Classic Bundle versions 2.2.3 and 1.7.16. The fix moves the checkPermission('predefined_properties') call to execute unconditionally at the beginning of the propertiesAction method, ensuring all requests (both read and write) are properly authorized. Security patches are available via the official GitHub releases:

• GitHub Release v2.2.3
• GitHub Release v1.7.16
• GitHub Security Advisory GHSA-hqrp-m84v-2m2f

Workarounds

• Restrict backend access to only trusted users until the patch can be applied
• Implement network-level access controls to limit who can reach the Pimcore admin interface
• Use a web application firewall (WAF) to block unauthorized requests to sensitive admin endpoints
• Consider temporarily disabling the Predefined Properties feature if not critical to operations

# Update Pimcore Admin Classic Bundle via Composer
composer update pimcore/admin-ui-classic-bundle --with-all-dependencies

# Verify installed version
composer show pimcore/admin-ui-classic-bundle | grep -i version