CVE-2026-23493
High · 8.6Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
CVSS
8.6
EPSS
0.4%
Published
Jan 15, 2026
CISA due date
—
The record
The http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session data, and other details can be accessed or recovered through the Pimcore backend.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pimcore/pimcore | 0 | 11.5.14 |
| Packagist | pimcore/pimcore | 12.0.0-RC1 | 12.3.1 |
| packagist | pimcore/pimcore | 12.0.0-RC1 | 12.3.1 |
Related vulnerabilities
- GHSA-q433-j342-rp9h Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Same vulnerability
- GHSA-vxg3-v4p6-f3fp Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE… Also affects pimcore/pimcore
- CVE-2026-27461 Pimcore is an Open Source Data & Experience Management Platform. Also affects pimcore/pimcore
- GHSA-m3r2-724c-pwgf Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Also affects pimcore/pimcore
- CVE-2026-23494 Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Also affects pimcore/pimcore
- GHSA-qvr7-7g55-69xj Pimcore Has an Incomplete Patch for CVE-2023-30848 Also affects pimcore/pimcore
- CVE-2026-23492 Pimcore Has an Incomplete Patch for CVE-2023-30848 Also affects pimcore/pimcore
- CVE-2022-1429 SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to… Also affects pimcore/pimcore