CVE-2026-45704: Pimcore CustomReports authorization bypass in report detail endpoint

CVE-2026-45704 · Severity: high · CVSS 4 · Published 2026-07-17

Pimcore, an open-source platform for managing digital data and customer experiences, contains a security flaw in its custom reporting module. An authorized staff member with basic reporting permissions can bypass sharing restrictions to view private reports they were not intended to see. This could lead to the exposure of sensitive business data, report configurations, and internal data source settings.

Technologies: pimcore/pimcore (Packagist), Pimcore. Vendors: Packagist, Pimcore.

Quick answers

Is CVE-2026-45704 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45704 being exploited in the wild.
How severe is CVE-2026-45704?
High severity, with a CVSS score of 4, published 17 July 2026.
Which products and versions are affected?
pimcore/pimcore (Packagist) <= 12.3.5, ECOSYSTEM:introduced=12.0.0-RC1,fixed=12.3.6; Pimcore < 11.5.17, >= 12.0.0 < 12.3.6, <= 12.3.5.
Is there a fix for CVE-2026-45704?
Yes. pimcore/pimcore (Packagist): upgrade to 12.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45704 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-45704?
Check whether you run pimcore/pimcore (Packagist) or Pimcore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pimcore/pimcore (Packagist): upgrade to 12.3.6 or later
    composer require pimcore/pimcore:^12.3.6

Technical details

An authorization inconsistency exists between the report listing and report detail endpoints in the CustomReportsBundle. While the listing endpoint correctly filters reports based on user-specific sharing rules, the detail endpoint (getAction) only verifies a generic 'reports' permission before loading a report by its name. This allows an authenticated attacker with basic reporting privileges to bypass 'shareGlobally=false' settings and retrieve sensitive metadata, including data source configurations and sharing settings. The vulnerability affects CustomReportController.php and Dao.php and has been patched in versions 11.5.17 (LTS) and 12.3.6.

Affected products

  • Pimcore Pimcore < 11.5.17, >= 12.0.0 < 12.3.6

Identifiers

  • CVE-2026-45704
  • GHSA-jwcc-gv4m-93x6

Timeline

  • 2026-04-29: patched: Fix merged into version 12.3 branch
  • 2026-05-26: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.