Cloudanix VulnDB

CVE-2026-45703

Medium · 6.4

Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export

CVSS

6.4

EPSS

0.3%

Published

May 27, 2026

CISA due date

—

The record

The `WordExport` export flow only checks whether the current backend user has the feature permission `word_export`. It does not verify access rights on the target element itself. As a result, a low-privileged backend user can export document content even when the user does not have `view` permission on that document. In the local Docker reproduction, a low-privileged user successfully exported sensitive content from a page the user was not allowed to view: - `POC-WORDEXPORT-TITLE` - `POC-WORDEXPORT-DESC`

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities