# CVE-2026-55207: Pimcore studio-backend-bundle account takeover via password reset URL injection

Source: https://junglewise.ai/threats/cve-2026-55207-pimcore-studio-backend-bundle-account-takeover-via-password-reset  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55207 · Severity: high · CVSS 8.8 · Published 2026-07-09

Pimcore is a digital experience platform and content management system used to manage websites, assets, and product data. An unauthenticated attacker can hijack any administrator account by injecting a malicious URL into the password reset request, intercepting the recovery token, and using it to gain full administrative access. The attack even bypasses two-factor authentication, allowing complete control over all website content, user accounts, and system configuration.

Technologies: [pimcore/studio-backend-bundle (Packagist)](https://junglewise.ai/threats/technologies/pimcore-studio-backend-bundle), [Pimcore](https://junglewise.ai/threats/technologies/pimcore), [Pimcore Studio Backend Bundle](https://junglewise.ai/threats/technologies/studio-backend-bundle). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pimcore](https://junglewise.ai/threats/vendors/pimcore).

## Quick answers

**Is CVE-2026-55207 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55207 being exploited in the wild.

**How severe is CVE-2026-55207?** High severity, with a CVSS score of 8.8, published 9 July 2026.

**Which products and versions are affected?** pimcore/studio-backend-bundle (Packagist) ECOSYSTEM:introduced=0,fixed=2025.4.6; Pimcore < 2025.4.6, >= 2026.1.0 and < 2026.1.6; Pimcore Studio Backend Bundle < 2025.4.6, >= 2026.1.0 and < 2026.1.6.

**Is there a fix for CVE-2026-55207?** Yes. pimcore/studio-backend-bundle (Packagist): upgrade to 2025.4.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55207 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55207?** Check whether you run pimcore/studio-backend-bundle (Packagist), Pimcore or Pimcore Studio Backend Bundle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pimcore/studio-backend-bundle (Packagist): upgrade to 2025.4.6 or later

  ```sh
  composer require pimcore/studio-backend-bundle:^2025.4.6
  ```


## Technical details

The vulnerability exists in the password reset endpoint (ResetPasswordController.php) which accepts a user-supplied resetPasswordUrl parameter with no validation—no scheme check, domain allowlist, or comparison against configured system domain. The vulnerable UserLoginService concatenates the attacker's URL with a cryptographically valid recovery token and sends it via email before the token is consumed. An attacker can intercept this token by hosting a simple web server at the injected URL. The AdminTokenAuthenticator explicitly disables 2FA when authenticating via token (setTwoFactorAuthentication('required', false)), allowing complete account compromise even on protected admin accounts. The token is valid for 24 hours, single-use, and encrypted with the application secret. No authentication is required to trigger the reset, and the email appears legitimate since it originates from the actual Pimcore server.

## Affected products

- Pimcore studio-backend-bundle < 2025.4.6, >= 2026.1.0 and < 2026.1.6
- Pimcore Pimcore 12.x (2026.x branch)

## Identifiers

- CVE-2026-55207
- GHSA-h854-c3m3-mh5v

## Timeline

- 2026-08-28: disclosed: Vulnerability published to GitHub Advisory Database
- 2026-06-29: patched: Patches released: studio-backend-bundle v2025.4.6 and v2026.1.6
- 2026-07-09: advisory: CVE-2026-55207 published to NVD

## References

- [https://api.github.com/users/byteoverride](https://api.github.com/users/byteoverride)
- [https://github.com/byteoverride](https://github.com/byteoverride)
- [https://api.github.com/users/byteoverride/gists%7B/gist_id%7D](https://api.github.com/users/byteoverride/gists%7B/gist_id%7D)
- [https://api.github.com/users/byteoverride/repos](https://api.github.com/users/byteoverride/repos)
- [https://avatars.githubusercontent.com/u/182125216?v=4](https://avatars.githubusercontent.com/u/182125216?v=4)
- [https://api.github.com/users/byteoverride/events%7B/privacy%7D](https://api.github.com/users/byteoverride/events%7B/privacy%7D)

## Related threats

- [Pimcore stored cross-site scripting in data objects](https://junglewise.ai/threats/cve-2026-109392-pimcore-through-2026-3-1-contains-a-stored-cross-site-scripting)
- [Pimcore SQL injection in Custom Reports via configuration](https://junglewise.ai/threats/cve-2026-55416-pimcore-sql-injection-in-custom-reports-via-configuration)
- [Pimcore ClassDefinition UID regex SQL injection in Block.php](https://junglewise.ai/threats/cve-2026-55072-pimcore-classdefinition-uid-regex-sql-injection-in-block-php)
- [Pimcore DataObject class-definition field name remote code execution](https://junglewise.ai/threats/cve-2026-55634-pimcore-dataobject-class-definition-field-name-remote-code)
- [Pimcore Hotspotimage unrestricted PHP object deserialization](https://junglewise.ai/threats/cve-2026-55220-pimcore-hotspotimage-unrestricted-php-object-deserialization)