Authorization bypass in Pimcore's CustomReports bundle (CVE-2026-45704)

CVE-2026-45704 is an authorization bypass vulnerability in Pimcore's CustomReports bundle where inconsistent access control between the report listing endpoint and the report detail endpoint allows a low-privileged authenticated backend user to retrieve report configurations directly by name, even for reports not shared with that user. An attacker with the `reports` permission can read unauthorized report metadata including data source configuration, column configuration, and sharing settings, and may also be able to access report data, chart, and CSV export endpoints that resolve reports by name in a similar manner. Affected versions: - <=11.5.16 We recommend updating to: 11.5.17 (LTS), 12.3.6. CVSS 7.1 · our assessment: this_week Vendor advisory: https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6 Details: https://vuln.today/cve/CVE-2026-45704