CVE-2026-23495 Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing
Authenticated users without property management permissions can access the full list of predefined property configurations via an unprotected API endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23495?
CVE-2026-23495 is a medium-severity missing authorization vulnerability in pimcore, published on 15 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.
Weakness: CWE-284
Which versions are affected by CVE-2026-23495?
4 open source packages ship an affected version, including pimcore/admin-ui-classic-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.7.16 |
pimcore/admin-ui-classic-bundle Packagist | All versions | 1.7.16 |
pimcore/admin-ui-classic-bundle Packagist | From 2.0.0-RC1 | 2.2.3 |
pimcore/admin-ui-classic-bundle Packagist | From 2.0.0-RC1 | 2.2.3 |
Products include Pimcore Admin Classic Bundle.
How do I fix CVE-2026-23495?
Upgrade pimcore/admin-ui-classic-bundle to a fixed version for your release line: 1.7.16 or 2.2.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-23495 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23495 exists.
Other vulnerabilities in pimcore
- CVE-2024-23646 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip
- CVE-2024-23648 Pimcore Admin Classic Bundle host header injection in the password reset
- CVE-2023-49075 Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2025-24980 Pimcore Admin Classic Bundle allows user enumeration
Sources
Also known as GHSA-hqrp-m84v-2m2f.