CVE-2026-45703: Pimcore Auth Bypass Vulnerability

CVE-2026-45703 Overview

CVE-2026-45703 is a missing authorization vulnerability [CWE-862] in Pimcore, an open source data and experience management platform. The flaw resides in the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php. The controller only validates the word_export feature permission and directly resolves attacker-controlled type and id parameters. It does not enforce view permission checks on pages, snippets, emails, or object elements. A low-privileged backend user can export document content they are not authorized to view. The issue affects Pimcore versions prior to 11.5.17 (LTS) and 12.3.7.

Critical Impact
Authenticated low-privileged backend users can exfiltrate document, snippet, email, and object content bypassing view permissions, leading to information disclosure.

Affected Products

Pimcore versions prior to 11.5.17 (LTS)
Pimcore 12.x versions prior to 12.3.7
Pimcore WordExportBundle component

Discovery Timeline

2026-07-17 - CVE-2026-45703 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-45703

Vulnerability Analysis

The vulnerability exists in Pimcore's WordExport translation workflow. The TranslationController handling the export flow performs only a single authorization check verifying the word_export feature permission. It then trusts the type and id request parameters to resolve the target element from the database and includes its content in the exported Word document. The controller never calls the standard Pimcore element-level isAllowed('view', $user) verification before returning content. This missing-authorization pattern maps to [CWE-862].

Any backend user granted the general word_export capability can enumerate document, snippet, email, or object identifiers and export their content. Restricted workspace boundaries that would normally prevent viewing the same elements through the standard UI are bypassed entirely through this endpoint.

Root Cause

The root cause is an incomplete authorization model in the WordExport controller. Feature-level permission gating protects the export function itself, but the element-level access control that Pimcore enforces on documents and objects elsewhere is absent. The controller resolves user-controlled identifiers directly against the data model without a permission gate between resolution and serialization.

Attack Vector

Exploitation requires network access to the Pimcore backend and authenticated credentials for any user account that holds the word_export feature permission. The attacker crafts an authenticated request to the WordExport endpoint supplying the numeric id and type of a target element outside their permitted workspace. The server returns the element's content inside a generated Word document. No user interaction is required and complexity is low. Because the scope changes from the low-privileged actor to the wider backend content graph, confidentiality of restricted content is impacted.

Detection Methods for CVE-2026-45703

Indicators of Compromise

Backend HTTP requests to the WordExport translation controller endpoint containing type and id parameters referencing elements outside the user's assigned workspace
Unusual volume of WordExport downloads from a single low-privileged backend account
Sequential enumeration patterns against the WordExport endpoint iterating through document or object IDs
Word document export events immediately following recent login by non-editor roles

Detection Strategies

Review Pimcore application logs and web server access logs for calls to the WordExportBundle translation controller and correlate the requested element IDs against the authenticated user's workspace scope
Alert on any WordExport request where the target element ID falls outside a permission boundary defined for that user
Baseline normal export activity per role and flag deviations, especially exports by users who do not typically produce translations

Monitoring Recommendations

Enable verbose audit logging for the Pimcore backend and forward logs to a centralized platform for retention and analysis
Monitor authentication events for backend accounts holding the word_export permission and review permission assignments regularly
Track outbound data volumes from Pimcore hosts to identify large or repeated document exports

How to Mitigate CVE-2026-45703

Immediate Actions Required

Upgrade Pimcore to version 11.5.17 (LTS) or 12.3.7, which contain the authorization fix in the WordExport flow
Audit backend user accounts and revoke the word_export feature permission from users who do not require translation export functionality
Review recent WordExport activity in application logs to identify potential unauthorized access to restricted content

Patch Information

The issue is fixed in Pimcore 11.5.17 (LTS) and 12.3.7. See the GitHub Release v12.3.7 and the GitHub Security Advisory GHSA-332x-r494-54fq for details on the corrected permission enforcement.

Workarounds

Temporarily remove the word_export permission from all non-administrative roles until upgrade is complete
Restrict network access to the Pimcore backend using IP allowlists or VPN to limit the pool of accounts that can reach the vulnerable endpoint
Add a reverse-proxy rule blocking access to the WordExport translation controller path for non-privileged users where feasible

bash

# Upgrade Pimcore using Composer to a patched release
composer require pimcore/pimcore:^12.3.7 --with-all-dependencies
# Or for the LTS branch
composer require pimcore/pimcore:^11.5.17 --with-all-dependencies

# Clear caches after upgrade
bin/console cache:clear