CVE-2026-45704 Pimcore: CustomReports Share Bypass
Low-privileged users can bypass sharing restrictions to read sensitive metadata and configuration of unshared custom reports in Pimcore.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45704?
CVE-2026-45704 is a high-severity missing authorization vulnerability in pimcore, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with the reports permission to directly request an unshared report such as poc-secret-report by name and read report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings even when shareGlobally is false. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
Weakness: CWE-862
Which versions are affected by CVE-2026-45704?
6 open source packages ship an affected version, including pimcore/pimcore.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | All versions | 11.5.17 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.6 |
pimcore/pimcore Packagist | From 12.0.0-RC1 | 12.3.6 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.2 |
pimcore/pimcore Packagist | From 2026.1.0 | 2026.1.2 |
How do I fix CVE-2026-45704?
Upgrade pimcore/pimcore to a fixed version for your release line: 11.5.17, 12.3.6 or 2026.1.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-45704 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45704 exists.
Sources
Also known as GHSA-jwcc-gv4m-93x6.