CoreShop CVE-2026-108697

Requires an authenticated CoreShop/Pimcore backend user account (PR:L) whose permissions do NOT include the targeted resources - the flaw lets such a user bypass the per-resource grant check. The exact trigger is requesting the auto-generated REST-style list routes handled by ResourceController::listAction, which omits the isGrantedOr403() authorization check that sibling actions enforce. Limiting factors that reduce real-world risk: valid backend credentials are mandatory (no anonymous/pre-auth access), impact is limited to read-only enumeration of resource metadata (ids, names, identifiers) for payment providers, carriers, price rules, stores, and tax rules, and no create/update/delete or sensitive secret exposure is indicated. Affects CoreShop versions through 2026.2.2 on default routing where these list endpoints are registered.

This is a low-to-moderate priority information-disclosure issue, not an urgent emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and base score of 5.3 indicate network-reachable, low-complexity exploitation but require an already-authenticated low-privileged backend (Pimcore) user - so this is a privilege-escalation-of-visibility / broken-access-control problem rather than a pre-auth breach. Impact is bounded to confidentiality (VC:L) with no integrity or availability effect (VI:N/VA:N) and no scope change, consistent with the CWE-862 missing-authorization classification: the listAction skips the isGrantedOr403() check, leaking resource metadata (ids, names, identifiers for payment providers, carriers, price rules, stores, tax rules) but not modifying data. No EPSS score, KEV listing, or confirmed public exploit code is present in the supplied data, so there is no public exploit identified at time of analysis; the available signals (authenticated access required, confidentiality-only, limited data exposure) all point to a genuinely low real-world risk despite the 'network' vector. Note a mild tension to verify: the vector is AV:N yet exploitation is gated behind backend authentication, so 'network' here means the backend admin UI/API is network-reachable, not that an anonymous internet attacker can trigger it.

A low-privileged employee or a compromised limited backend account that legitimately logs into the CoreShop/Pimcore admin, but who has not been granted permissions to stores, pricing, tax, carriers, or payment configuration, directly requests the generated resource list routes. Because ResourceController::listAction omits the isGrantedOr403() authorization check, the server returns the full enumeration of those restricted resources. No public exploit code is identified at time of analysis, though a technical write-up (hackmd) and VulnCheck advisory describe the flaw.