What is the CVSS score of CVE-2026-23495?

CVE-2026-23495 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Admin Classic Bundle are affected by CVE-2026-23495?

Organizations using Classic Bundle provides a Backend UI for Pimcore. should be aware of moderate risk from CVE-2026-23495, a improper access control vulnerability rated CVSS 4.3.. A patch is available.

Is there a public PoC exploit available for CVE-2026-23495?

Yes, a public proof-of-concept exploit is available for CVE-2026-23495. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-23495?

Within 30 days: Identify affected systems running Classic Bundle provides a Backend UI for Pimcore. and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Admin Classic Bundle CVE-2026-23495

MEDIUM

Improper Access Control (CWE-284)

2026-01-15 security-advisories@github.com

GHSA-hqrp-m84v-2m2f

Authentication Bypass Admin Classic Bundle

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 30, 2026 - 19:51 vuln.today

Public exploit code

Patch released

Jan 30, 2026 - 19:51 nvd

Patch available

CVE Published

Jan 15, 2026 - 17:16 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.

AnalysisAI

Pimcore Admin Classic Bundle versions prior to 2.2.3 and 1.7.16 fail to enforce proper authorization on the Predefined Properties API endpoint, allowing authenticated backend users without explicit permissions to enumerate all property configurations. Public exploit code exists for this vulnerability. The flaw impacts any Pimcore deployment where backend user access controls rely on role-based restrictions for sensitive metadata definitions.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Admin Classic Bundle. Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed tha