# CVE-2026-55212: Pimcore Studio API privilege escalation in class definition creation

Source: https://junglewise.ai/threats/cve-2026-55212-pimcore-studio-api-privilege-escalation-in-class-definition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55212 · Severity: high · CVSS 7.1 · Published 2026-07-09

Pimcore's Studio API endpoint for creating class definitions incorrectly validates permissions, allowing any content editor with the standard "objects" permission to create new database tables and PHP class files—operations normally restricted to administrators. This privilege escalation lets unprivileged users modify the application schema, introduce structural data model changes, and trigger server-side operations outside their permission scope.

Technologies: [pimcore/studio-backend-bundle (Packagist)](https://junglewise.ai/threats/technologies/pimcore-studio-backend-bundle), [Pimcore Studio Backend Bundle](https://junglewise.ai/threats/technologies/studio-backend-bundle). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Pimcore](https://junglewise.ai/threats/vendors/pimcore).

## Quick answers

**Is CVE-2026-55212 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55212 being exploited in the wild.

**How severe is CVE-2026-55212?** High severity, with a CVSS score of 7.1, published 9 July 2026.

**Which products and versions are affected?** pimcore/studio-backend-bundle (Packagist) ECOSYSTEM:introduced=0,fixed=2026.1.6; Pimcore Studio Backend Bundle < 2025.4.6, >= 2026.1.0, < 2026.1.6.

**Is there a fix for CVE-2026-55212?** Yes. pimcore/studio-backend-bundle (Packagist): upgrade to 2026.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55212 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55212?** Check whether you run pimcore/studio-backend-bundle (Packagist) or Pimcore Studio Backend Bundle at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pimcore/studio-backend-bundle (Packagist): upgrade to 2026.1.6 or later

  ```sh
  composer require pimcore/studio-backend-bundle:^2026.1.6
  ```


## Technical details

Two permission and validation issues exist in `pimcore/studio-backend-bundle`. First, the endpoint `POST /pimcore-studio/api/class/definition/configuration-view/detail/create` is protected by the `DATA_OBJECTS` permission (guarding data object editing) rather than the `CLASSES` permission (required for class definition management in Classic Admin). Any authenticated user with object-editing rights can exploit this to create class definitions, bypassing admin-only restrictions. Second, the `CreateClassDefinitionParameters` class performs only an empty-string check on the `uid` field; it lacks the anchored regex validation (`/^[a-zA-Z0-9][a-zA-Z0-9_]*$/`) that exists in the model layer, allowing malformed UIDs to reach the model layer and trigger unhandled internal exceptions that expose stack traces in debug configurations. Authentication is required (valid Pimcore session with `objects` permission), and no victim interaction is needed. The vulnerability is fixed in versions 2025.4.6 and 2026.1.6.

## Affected products

- Pimcore studio-backend-bundle < 2025.4.6, >= 2026.1.0 < 2026.1.6

## Identifiers

- CVE-2026-55212
- GHSA-f97c-ph8j-8vff

## Timeline

- 2026-08-28: disclosed: Published to GitHub Advisory Database
- 2026-06-29: patched: Fix released in versions 2025.4.6 and 2026.1.6

## References

- [https://api.github.com/users/dhairya7760](https://api.github.com/users/dhairya7760)
- [https://github.com/dhairya7760](https://github.com/dhairya7760)
- [https://api.github.com/users/dhairya7760/gists%7B/gist_id%7D](https://api.github.com/users/dhairya7760/gists%7B/gist_id%7D)
- [https://api.github.com/users/dhairya7760/repos](https://api.github.com/users/dhairya7760/repos)
- [https://avatars.githubusercontent.com/u/56912333?v=4](https://avatars.githubusercontent.com/u/56912333?v=4)
- [https://api.github.com/users/dhairya7760/events%7B/privacy%7D](https://api.github.com/users/dhairya7760/events%7B/privacy%7D)

## Related threats

- [Pimcore Studio Backend Bundle SQL injection in DateFilter](https://junglewise.ai/threats/cve-2026-55208-pimcore-studio-backend-bundle-sql-injection-in-datefilter)
- [Pimcore studio-backend-bundle account takeover via password reset URL injection](https://junglewise.ai/threats/cve-2026-55207-pimcore-studio-backend-bundle-account-takeover-via-password-reset)