Executive brief
UnoPim is an open-source Product Information Management (PIM) platform used to manage product data and digital assets. A flaw in the authorization system allows any admin user—even those with minimal permissions—to bypass security controls and create OAuth API credentials with full administrative access, enabling unauthorized data access and modification across the entire system.
Technical details
UnoPim uses a custom ACL middleware (Bouncer) to enforce permissions on routes, but the integration management routes (store, update, and key-generation) are missing from the ACL configuration map. When a request arrives for an unregistered route, the checkIfAuthorized() function in Bouncer.php returns without performing any permission validation. An authenticated admin attacker can exploit this by calling the unprotected POST /admin/integrations/api-keys/create and /admin/integrations/api-keys/generate endpoints to create an OAuth integration tied to a superadmin account, mint client credentials, and escalate to full API access. No secondary authorization checks exist in the ApiKeysController methods. The vulnerability requires only admin-level authentication and network access; no user interaction is needed.
Affected products
- UnoPim UnoPim before 2.1.3
Timeline
- 2026-09-03: disclosed
- other: Confirmed vulnerable in commit 3e894245 (v2.1.2)