GHSA-m3r2-724c-pwgf
Medium · 4.3CVSS
4.3
EPSS
—
Published
Jan 15, 2026
CISA due date
—
The record
Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on "Static Routes" Listing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | pimcore/pimcore | 0 | 11.5.14 |
| Packagist | pimcore/pimcore | 12.0.0-RC1 | 12.3.1 |
| packagist | pimcore/pimcore | 12.0.0-RC1 | 12.3.1 |
Related vulnerabilities
- CVE-2026-23494 Pimcore is Vulnerable to Broken Access Control: Missing Function Level Authorization on… Same vulnerability
- GHSA-vxg3-v4p6-f3fp Pimcore vulnerable to SQL injection via unsanitized filter value in Dependency Dao RLIKE… Also affects pimcore/pimcore
- CVE-2026-27461 Pimcore is an Open Source Data & Experience Management Platform. Also affects pimcore/pimcore
- GHSA-q433-j342-rp9h Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Also affects pimcore/pimcore
- CVE-2026-23493 Pimcore ENV Variables and Cookie Informations are exposed in http_error_log Also affects pimcore/pimcore
- GHSA-qvr7-7g55-69xj Pimcore Has an Incomplete Patch for CVE-2023-30848 Also affects pimcore/pimcore
- CVE-2026-23492 Pimcore Has an Incomplete Patch for CVE-2023-30848 Also affects pimcore/pimcore
- CVE-2022-1429 SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to… Also affects pimcore/pimcore