CVE-2026-45704
Received Received - Intake

Authorization Bypass in Pimcore CustomReports

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: GitHub, Inc.

Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with the reports permission to directly request an unshared report such as poc-secret-report by name and read report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings even when shareGlobally is false. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-17
Last Modified
2026-07-17
Generated
2026-07-18
AI Q&A
2026-07-17
EPSS Evaluated
N/A
NVD
CVE-2026-45704

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
pimcore customreports to 11.5.17|end_excluding=12.3.6 (exc)
pimcore customreports to 11.5.17 (inc)
pimcore customreports to 12.3.6 (inc)
pimcore pimcore to 12.3.6 (exc)
pimcore pimcore 12.3.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45704 is a security flaw in Pimcore's CustomReports bundle where authorization checks are inconsistent between listing and detail endpoints. A low-privileged user with the 'reports' permission can bypass sharing rules and directly access unshared reports by name, retrieving sensitive metadata like configurations and settings.

Detection Guidance

Check Pimcore version with: composer show pimcore/pimcore. If using 11.x, verify it is >=11.5.17 (LTS). For 12.x, ensure >=12.3.6. Inspect CustomReportsBundle files for unauthorized access attempts in logs. Look for direct report name requests in access logs like /admin/custom-report/get/{reportName}.

Impact Analysis

An attacker could exploit this to read unauthorized report details, including names, data sources, column setups, and sharing settings. This may reveal sensitive information, aid further attacks, or lead to data leaks if reports contain confidential data.

Compliance Impact

This vulnerability could violate compliance by exposing sensitive report data without proper authorization. GDPR requires data protection and access controls, while HIPAA mandates strict access to health information. Unauthorized access risks breaches and non-compliance penalties.

Mitigation Strategies

Upgrade Pimcore to 11.5.17 (LTS) or 12.3.6 or later. Review backend user permissions, removing unnecessary 'reports' permissions. Audit report sharing settings to ensure only intended users have access. Monitor for unauthorized report access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45704. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart