CVE-2026-23495
📋 TL;DR
This vulnerability allows authenticated backend users without proper permissions to access the complete list of Predefined Properties configurations in Pimcore's Admin Classic Bundle. It affects organizations using Pimcore with the Admin Classic Bundle for content management. The issue exposes metadata definitions that could reveal sensitive information about data structures and workflows.
💻 Affected Systems
- Pimcore Admin Classic Bundle
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker with authenticated access could map the entire Predefined Properties configuration, potentially identifying sensitive metadata fields, understanding data structures, and planning further attacks based on exposed system information.
Likely Case
Unauthorized users within the organization could access property configurations they shouldn't see, potentially learning about sensitive data fields or proprietary metadata structures used in the platform.
If Mitigated
With proper access controls and monitoring, the impact is limited to information disclosure about metadata structures rather than actual data exposure.
🎯 Exploit Status
Exploitation requires authenticated access to the Pimcore backend. The vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.16 or 2.2.3
Vendor Advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-hqrp-m84v-2m2f
Restart Required: No
Instructions:
1. Identify your Admin Classic Bundle version. 2. Update to version 1.7.16 if using version 1.x. 3. Update to version 2.2.3 if using version 2.x. 4. Verify the update was successful by checking the bundle version.
🔧 Temporary Workarounds
Restrict API endpoint access
allImplement network-level restrictions or web application firewall rules to limit access to the vulnerable API endpoint
Review and restrict user permissions
allAudit and minimize backend user permissions to reduce the attack surface
🧯 If You Can't Patch
- Implement strict access controls and monitor API endpoint usage
- Segment network access to limit which users can reach the Pimcore backend interface
🔍 How to Verify
Check if Vulnerable:
Check if your Admin Classic Bundle version is below 1.7.16 (for 1.x) or below 2.2.3 (for 2.x)Check Version:
Check composer.json or run: php bin/console pimcore:bundle:list | grep 'Admin Classic Bundle'Verify Fix Applied:
Verify the bundle version shows 1.7.16 or higher for 1.x, or 2.2.3 or higher for 2.x📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to property listing endpoints from users without property management permissions
- Multiple rapid requests to /admin/property/predefined-properties endpoint
Network Indicators:
- HTTP GET requests to property listing API endpoints from unauthorized IPs or users
SIEM Query:
source="pimcore" AND (uri_path="/admin/property/predefined-properties" OR uri_path LIKE "%/property/predefined%") AND user_role NOT IN ("property_manager", "admin")🔗 References
- https://github.com/pimcore/admin-ui-classic-bundle/commit/98095949fbeaf11cdf4cadb2989d7454e1b88909
- https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.7.16
- https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v2.2.3
- https://github.com/pimcore/pimcore/security/advisories/GHSA-hqrp-m84v-2m2f
