CVE-2026-45704: Pimcore Auth Bypass Vulnerability

CVE-2026-45704 Overview

CVE-2026-45704 is a missing authorization vulnerability [CWE-862] in Pimcore, an open source Data & Experience Management Platform. The flaw resides in the CustomReportsBundle, where inconsistent authorization checks between the report listing endpoint and the report detail endpoint permit unauthorized data access. A low-privileged backend user holding the reports permission can directly request an unshared report by name and read its full configuration. Affected files include bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php. The issue is fixed in versions 11.5.17 (LTS) and 12.3.6.

Critical Impact
Authenticated low-privileged backend users can retrieve unshared custom report definitions, including report names, data source configuration, column configuration, grouping information, and sharing settings even when shareGlobally is set to false.

Affected Products

Pimcore versions prior to 11.5.17 (LTS)
Pimcore 12.x versions prior to 12.3.6
Pimcore CustomReportsBundle component

Discovery Timeline

2026-07-17 - CVE-2026-45704 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-45704

Vulnerability Analysis

The vulnerability originates from inconsistent authorization enforcement across two related endpoints in the Pimcore CustomReportsBundle. The report listing endpoint applies sharing checks that restrict which reports a low-privileged user can see. The report detail endpoint, however, does not enforce the same sharing checks when a report is requested directly by name.

An authenticated backend user with the reports permission can bypass the listing filter by submitting a direct request referencing a known or guessed report name such as poc-secret-report. The application returns the report's metadata regardless of its shareGlobally flag or per-user sharing configuration. Exposed fields include report name, grouping information, display and icon metadata, data source configuration (SQL queries or data providers), column configuration, and sharing settings.

Disclosure of data source configuration is particularly impactful because custom reports often contain SQL queries referencing internal schemas, joins, and filters that reveal business logic and data model structure.

Root Cause

The root cause is a missing authorization check [CWE-862] on the report detail retrieval path. The listing DAO in bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php filters reports based on sharing, but the controller action in CustomReportController.php loads reports by identifier without re-evaluating whether the requesting user is entitled to view that specific report.

Attack Vector

Exploitation requires network access to the Pimcore backend and valid credentials for a low-privileged account that holds the reports permission. No user interaction is required beyond the attacker submitting a crafted request. The attacker must know or enumerate the target report name.

php

 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\ResponseHeaderBag;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\Routing\Attribute\Route;
 use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
 use function array_key_exists;

Source: GitHub Commit 1893ff1 — the patch imports AccessDeniedHttpException so the controller can raise HTTP 403 when a user requests a report they are not authorized to view.

Detection Methods for CVE-2026-45704

Indicators of Compromise

Backend HTTP requests to Pimcore custom report endpoints referencing report names that the requesting user has not been explicitly shared.
Access log entries showing low-privileged accounts retrieving report detail responses containing dataSourceConfig or columnConfiguration fields.
Repeated report-name enumeration patterns from a single authenticated session.

Detection Strategies

Correlate the Pimcore user role and sharing model with each successful report detail response and flag mismatches.
Baseline typical report access patterns per role, then alert on low-privileged users retrieving reports not present in their listing responses.
Review web application firewall (WAF) and reverse proxy logs for direct requests to custom report endpoints outside expected admin workflows.

Monitoring Recommendations

Enable and centralize Pimcore backend audit logging, forwarding events to a SIEM or data lake for long-term retention.
Monitor for privilege-permission drift where the reports permission is granted to accounts that do not require reporting access.
Alert on anomalous JSON responses from report endpoints that include SQL fragments or data source connection identifiers.

How to Mitigate CVE-2026-45704

Immediate Actions Required

Upgrade Pimcore to 11.5.17 (LTS) or 12.3.6 as tracked in the GitHub Security Advisory GHSA-jwcc-gv4m-93x6.
Audit all backend users assigned the reports permission and revoke it from accounts that do not require report access.
Review existing custom reports for sensitive data source queries and rotate any embedded credentials or exposed identifiers.

Patch Information

The fix is delivered in Pimcore 11.5.17 (LTS) and 12.3.6. The patch introduced in pull request #19099 adds an explicit authorization check in the custom report controller and raises AccessDeniedHttpException when a user requests a report they are not entitled to view. Release artifacts are available on the Pimcore v12.3.6 release page.

Workarounds

Temporarily remove the reports permission from low-privileged roles until the upgrade is applied.
Restrict network access to the Pimcore admin interface using an allowlist of trusted administrator IP ranges.
Rename sensitive custom reports so that direct-name enumeration is less predictable, while treating this only as defense in depth rather than a fix.

bash

# Verify installed Pimcore version and upgrade via Composer
composer show pimcore/pimcore | grep versions
composer require pimcore/pimcore:^12.3.6 --with-all-dependencies
# For LTS branch
composer require pimcore/pimcore:^11.5.17 --with-all-dependencies
bin/console cache:clear --env=prod