TI-2020-16067 Aliases CVE-2020-26246

Authorization bypass in Pimcore

LOW 35CWE-285Published 2020-12-03 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Pimcore is an open source digital experience platform. In Pimcore before version 6.8.5 it is possible to modify & create website settings without having the appropriate permissions.

Why it matters now

EPSS 0.00807 57th percentileScored 2026-11-07

Fix Fixed pimcore (pimcore): 6.8.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pimcore	pimcore	before 6.8.5	6.8.5	Patch available	CNA

pimcore Vendorpimcore Affected before 6.8.5 Fixed in 6.8.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pimcore:pimcore::::::::	before 6.8.5	Vulnerable	pimcore

cpe:2.3:a:pimcore:pimcore:*:*:*:*:*:*:*:* Versions before 6.8.5 Vulnerable ·pimcore

Remediation

Fix · CNA pimcore (pimcore) Fixed in 6.8.5

Timeline

2026-10-02 Threatist record created from CVE-2020-26246

References

Patch 1

https://github.com/pimcore/pimcore/pull/7618

Advisory 1

https://github.com/pimcore/pimcore/security/advisories/GHSA-7p8p-4253-3mg6

TI-2026-18925 Pimcore has a Blind SQL Injection in Admin Search Find API due to an incomplete fix for CVE-2023-30848 CVSS 3.1HIGH 8.8
TI-2026-18926 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log CVSS 3.1HIGH 8.6
TI-2023-01489 SQL Injection in pimcore/pimcore CVSS 3.1HIGH 8.8
TI-2019-08091 An issue was discovered in Pimcore before 5.7.1. CVSS 3.0HIGH 8.8
TI-2023-25778 SQL Injection in Admin Grid Filter API in Pimcore CVSS 3.1HIGH 8.8
TI-2023-10682 An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. CVSS 3.1HIGH 8.8

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences