Executive brief
Pimcore, an open-source platform for managing digital data and customer experiences, contains a security flaw in its custom reporting module. An authorized staff member with basic reporting permissions can bypass sharing restrictions to view private reports they were not intended to see. This could lead to the exposure of sensitive business data, report configurations, and internal data source settings.
Technical details
An authorization inconsistency exists between the report listing and report detail endpoints in the CustomReportsBundle. While the listing endpoint correctly filters reports based on user-specific sharing rules, the detail endpoint (getAction) only verifies a generic 'reports' permission before loading a report by its name. This allows an authenticated attacker with basic reporting privileges to bypass 'shareGlobally=false' settings and retrieve sensitive metadata, including data source configurations and sharing settings. The vulnerability affects CustomReportController.php and Dao.php and has been patched in versions 11.5.17 (LTS) and 12.3.6.
Affected products
- Pimcore Pimcore < 11.5.17, >= 12.0.0 < 12.3.6
Timeline
- 2026-04-29: patched: Fix merged into version 12.3 branch
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD