# CVE-2026-108697: CoreShop missing authorization in ResourceController list

Source: https://junglewise.ai/threats/cve-2026-108697-coreshop-through-2026-2-2-contains-a-missing-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108697 · Severity: medium · CVSS 4.3 · Published 2026-10-11

CoreShop is an e-commerce platform built on Pimcore that manages product catalogs, payments, and orders. A missing authorization check allows low-privileged employees with backend access to view restricted business data like payment methods, shipping carriers, pricing rules, and tax configurations that they should not see. An attacker with basic employee credentials could enumerate sensitive business configuration details.

Technologies: [CoreShop](https://junglewise.ai/threats/technologies/coreshop). Vendors: [CoreShop](https://junglewise.ai/threats/vendors/coreshop).

## Quick answers

**Is CVE-2026-108697 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108697 being exploited in the wild.

**How severe is CVE-2026-108697?** Medium severity, with a CVSS score of 4.3, published 11 October 2026.

**Which products and versions are affected?** CoreShop through 2026.2.2.

**Is there a fix for CVE-2026-108697?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-108697 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-108697?** Check whether you run CoreShop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ResourceController listAction method skips the isGrantedOr403() authorization check present in other methods, allowing authenticated Pimcore users without proper permissions to retrieve list routes. This affects payment providers, carriers, price rules, stores, and tax rules endpoints. The vulnerability requires valid backend authentication but bypasses resource-level permission enforcement.

## Affected products

- CoreShop CoreShop through 2026.2.2

## Timeline

- 2026-10-11: disclosed

## References

- [https://github.com/coreshop/CoreShop](https://github.com/coreshop/CoreShop)
- [https://github.com/coreshop/CoreShop/blob/2026.2.2/src/CoreShop/Bundle/PayumPaymentBundle/Controller/PaymentProviderController.php](https://github.com/coreshop/CoreShop/blob/2026.2.2/src/CoreShop/Bundle/PayumPaymentBundle/Controller/PaymentProviderController.php)

## Related threats

- [coreshop CoreShop RCE via insecure pull_request_target in GitHub Actions](https://junglewise.ai/threats/cve-2026-41249-coreshop-coreshop-rce-via-insecure-pull-request-target-in-github)
- [CoreShop Vulnerable to SQL Injection via Admin Reports](https://junglewise.ai/threats/cve-2026-22242-coreshop-vulnerable-to-sql-injection-via-admin-reports)