CVE-2026-55207 Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
Unauthenticated attackers can hijack admin accounts and bypass 2FA by injecting a malicious URL into password reset requests, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55207?
CVE-2026-55207 is a high-severity authentication bypass vulnerability in pimcore, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used with POST /pimcore-studio/api/login/token to authenticate with full admin privileges while bypassing two-factor authentication. This issue is fixed in versions 2025.4.6 and 2026.1.6.
Weakness: CWE-640
Which versions are affected by CVE-2026-55207?
4 open source packages ship an affected version, including pimcore/studio-backend-bundle.
| Package | Affected | Fixed in |
|---|---|---|
pimcore/studio-backend-bundle Packagist | All versions | 2025.4.6 |
pimcore/studio-backend-bundle Packagist | All versions | 2025.4.6 |
pimcore/studio-backend-bundle Packagist | From 2026.1.0 | 2026.1.6 |
pimcore/studio-backend-bundle Packagist | From 2026.1.0 | 2026.1.6 |
How do I fix CVE-2026-55207?
Upgrade pimcore/studio-backend-bundle to a fixed version for your release line: 2025.4.6 or 2026.1.6.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-55207 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55207 exists.
Sources
Also known as GHSA-h854-c3m3-mh5v.