Read the docs
TI-2026-18928 Aliases CVE-2026-23495GHSA-hqrp-m84v-2m2f

Pimcore's Admin Classic Bundle is Missing Function Level Authorization on "Predefined Properties" Listing

Priority MEDIUM 53CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0036 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed pimcore (pimcore): 2.2.3, 1.7.16pimcore/admin-ui-classic-bundle (Packagist): 2.2.3, 1.7.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pimcorepimcore2.0.0-RC1 to before 2.2.3; before 1.7.162.2.3, 1.7.16Patch availableCNA
—pimcore/admin-ui-classic-bundle (Packagist)2.0.0-RC1 to before 2.2.32.2.3Patch availableGHSA-hqrp-m84v-2m2f
—pimcore/admin-ui-classic-bundle (Packagist)before 1.7.161.7.16Patch availableGHSA-hqrp-m84v-2m2f
  • pimcore Vendorpimcore Affected 2.0.0-RC1 to before 2.2.3; before 1.7.16 Fixed in 2.2.3, 1.7.16 Patch available CNA
  • pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected 2.0.0-RC1 to before 2.2.3 Fixed in 2.2.3 Patch available GHSA-hqrp-m84v-2m2f
  • pimcore/admin-ui-classic-bundle (Packagist) Vendor— Affected before 1.7.16 Fixed in 1.7.16 Patch available GHSA-hqrp-m84v-2m2f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:*before 1.7.16; 2.0.0 to before 2.2.3Vulnerablepimcore
  • cpe:2.3:a:pimcore:admin_classic_bundle:*:*:*:*:*:pimcore:*:* Versions before 1.7.16; 2.0.0 to before 2.2.3 Vulnerable ·pimcore

Remediation

  • Fix · CNA pimcore (pimcore) Fixed in 2.2.3, 1.7.16
  • Fix · GHSA-hqrp-m84v-2m2f pimcore/admin-ui-classic-bundle (Packagist) Fixed in 2.2.3 Advisory →
  • Fix · GHSA-hqrp-m84v-2m2f pimcore/admin-ui-classic-bundle (Packagist) Fixed in 1.7.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23495
  2. 2026-10-03 Alias added: GHSA-hqrp-m84v-2m2f

References

Exploit 1

Patch 1

Advisory 1

Other 3

  • TI-2024-15667 Pimcore Admin Classic Bundle host header injection in the password reset CVSS 3.1HIGH 8.8
  • TI-2024-16853 Pimcore Host Header Injection in user invitation link CVSS 3.1CRITICAL 9.3
  • TI-2024-15665 Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip CVSS 3.1HIGH 8.8
  • TI-2025-18658 Pimcore Admin Classic Bundle allows user enumeration CVSS 4.0MEDIUM 6.9
  • TI-2023-05380 Unverified Password Change in pimcore/admin-ui-classic-bundle CVSS 3.1HIGH 7.2
  • TI-2023-25777 Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle CVSS 3.1MEDIUM 5.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences