CVE-2026-23494
📋 TL;DR
This CVE describes an authorization bypass vulnerability in Pimcore's API endpoint for static routes. Authenticated backend users without proper permissions can access sensitive route configurations, potentially exposing custom URL patterns and controller details. This affects Pimcore installations prior to versions 12.3.1 and 11.5.14.
💻 Affected Systems
- Pimcore
📦 What is this software?
Pimcore by Pimcore
Pimcore by Pimcore
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map internal application structure, discover hidden endpoints, and potentially chain with other vulnerabilities to gain unauthorized access to sensitive functionality.
Likely Case
Information disclosure of custom route configurations, potentially revealing internal application architecture and sensitive path patterns.
If Mitigated
Minimal impact with proper authorization controls and network segmentation limiting access to backend interfaces.
🎯 Exploit Status
Exploitation requires authenticated backend access and involves simple API calls to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.3.1 or 11.5.14
Vendor Advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf
Restart Required: No
Instructions:
1. Update Pimcore to version 12.3.1 (for v12) or 11.5.14 (for v11). 2. Verify the update completed successfully. 3. Test API endpoint authorization controls.
🔧 Temporary Workarounds
Restrict Backend Access
allLimit access to backend interfaces to authorized personnel only using network controls.
API Endpoint Restriction
allImplement web application firewall rules to block unauthorized access to /api/static-routes endpoint.
🧯 If You Can't Patch
- Implement strict access controls for backend users and review user permissions regularly.
- Monitor API access logs for unauthorized requests to static routes endpoint.
🔍 How to Verify
Check if Vulnerable:
Check Pimcore version via admin interface or by examining the installation directory. Versions below 12.3.1 (for v12) or 11.5.14 (for v11) are vulnerable.Check Version:
Check Pimcore version in admin dashboard or via composer show pimcore/pimcoreVerify Fix Applied:
After updating, test API endpoint access with a low-privilege backend user account to ensure proper authorization checks are enforced.📡 Detection & Monitoring
Log Indicators:
- Unauthorized GET requests to /api/static-routes endpoint
- Multiple failed authorization attempts for static routes API
Network Indicators:
- Unusual API traffic patterns to static routes endpoint from unauthorized users
SIEM Query:
source="pimcore" AND (uri_path="/api/static-routes" OR endpoint="static-routes") AND user_role!="admin"🔗 References
- https://github.com/pimcore/pimcore/pull/18893
- https://github.com/pimcore/pimcore/releases/tag/v11.5.14
- https://github.com/pimcore/pimcore/releases/tag/v12.3.1
- https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf
- https://github.com/pimcore/pimcore/security/advisories/GHSA-m3r2-724c-pwgf
