CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
Low-privileged users can export unauthorized document content due to missing view permission checks in the WordExport feature.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45703?
CVE-2026-45703 is a medium-severity missing authorization vulnerability in pimcore, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.
Weakness: CWE-862
Which versions are affected by CVE-2026-45703?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.7 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.3 |
How do I fix CVE-2026-45703?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.17, 12.3.7 or 2026.1.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45703 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45703 exists.
Sources
Also known as GHSA-332x-r494-54fq.