CVE-2026-23496
📋 TL;DR
This CVE describes an authorization bypass vulnerability in Pimcore Web2Print Tools Bundle. Authenticated backend users without proper permissions can modify or retrieve Favourite Output Channel Configurations via an API endpoint. This affects Pimcore installations using Web2Print Tools Bundle versions prior to 5.2.2 and 6.1.1.
💻 Affected Systems
- Pimcore Web2Print Tools Bundle
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Malicious authenticated users could modify output channel configurations to disrupt printing workflows, potentially causing business process disruption or data integrity issues.
Likely Case
Unauthorized users with backend access could view or modify output channel settings, leading to misconfigured print outputs or unauthorized access to configuration data.
If Mitigated
With proper authorization controls, only authorized administrators can manage output channel configurations, maintaining workflow integrity.
🎯 Exploit Status
Exploitation requires authenticated backend access and knowledge of the vulnerable API endpoint. No authentication bypass is involved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.2.2 or 6.1.1
Vendor Advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r
Restart Required: No
Instructions:
1. Update Pimcore Web2Print Tools Bundle to version 5.2.2 (for Pimcore 5.x) or 6.1.1 (for Pimcore 6.x). 2. Verify the update via composer or package manager. 3. Clear application cache if required.
🔧 Temporary Workarounds
Temporary API Endpoint Restriction
allTemporarily restrict access to the vulnerable API endpoint using web server rules or application firewall.
# Example for Apache: RewriteRule ^/admin/web2print/favourite-output-channel-configurations - [F]
# Example for Nginx: location ~ /admin/web2print/favourite-output-channel-configurations { deny all; }
🧯 If You Can't Patch
- Implement strict access controls to limit backend user permissions to only necessary functions.
- Monitor API access logs for unauthorized attempts to access the vulnerable endpoint.
🔍 How to Verify
Check if Vulnerable:
Check the installed version of pimcore/web2print-tools via composer: composer show pimcore/web2print-toolsCheck Version:
composer show pimcore/web2print-tools | grep versionsVerify Fix Applied:
Verify the installed version is 5.2.2 or higher (for Pimcore 5.x) or 6.1.1 or higher (for Pimcore 6.x). Test API endpoint access with unauthorized user accounts.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /admin/web2print/favourite-output-channel-configurations endpoint
- API calls to modify output channel configurations from non-admin users
Network Indicators:
- HTTP POST/PUT requests to the vulnerable endpoint from unauthorized user accounts
SIEM Query:
source="pimcore.log" AND (uri_path="/admin/web2print/favourite-output-channel-configurations" AND user_role!="admin")🔗 References
- https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r
- https://github.com/pimcore/web2print-tools/commit/7714452a04b9f9b077752784af4b8d0b05e464a1
- https://github.com/pimcore/web2print-tools/pull/108
- https://github.com/pimcore/web2print-tools/releases/tag/v5.2.2
- https://github.com/pimcore/web2print-tools/releases/tag/v6.1.1
- https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r
