CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration

What is CVE-2025-24980?

CVE-2025-24980 is a medium-severity vulnerability in pimcore admin-ui-classic-bundle, published on 7 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-204

Which versions are affected by CVE-2025-24980?

2 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.

Products include Pimcore Admin Classic Bundle.

How do I fix CVE-2025-24980?

Upgrade pimcore/admin-ui-classic-bundle to 1.7.4 or later.

Is CVE-2025-24980 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24980 exists.

Other vulnerabilities in pimcore admin-ui-classic-bundle

• CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip High 8.8
• CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset High 8.8
• CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls High 8.5
• CVE-2024-25625 Pimcore Host Header Injection in user invitation link High 8.1
• CVE-2024-24822 Pimcore Admin Classic Bundle permissions are not getting checked when working with tags Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vr5f-php7-rg24.