What is the CVSS score of CVE-2026-55207?

CVE-2026-55207 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Pimcore are affected by CVE-2026-55207?

Pimcore Studio backend versions prior to 2025.4.6 and 2026.1.6 contain an unauthenticated authentication bypass enabling attackers with knowledge of a valid admin username to completely compromise…. A patch is available.

How to fix or mitigate CVE-2026-55207?

Within 24 hours: Implement monitoring and alerting on all admin account password-reset requests and unusual login patterns; disable Pimcore password-reset functionality if operationally feasible. Within 7 days: Apply administrative access restrictions by IP whitelist to studio backend from corporate networks only; prepare testing and deployment of Pimcore 2025.4.6 or 2026.1.6 (or later) once available. Within 30 days: Deploy patched Pimcore version; audit all admin account activity logs for unauthorized access during vulnerability window; enforce hardware-key-based 2FA for all administrative accounts.

Pimcore CVE-2026-55207

EUVD-2026-42698 HIGH

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-07-09 security-advisories@github.com

GHSA-h854-c3m3-mh5v

Authentication Bypass

8.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (github) · only source for this CVE.

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 09, 2026 - 22:01 EUVD

Analysis Generated

Jul 09, 2026 - 21:38 vuln.today

DescriptionCVE.org

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used with POST /pimcore-studio/api/login/token to authenticate with full admin privileges while bypassing two-factor authentication. This issue is fixed in versions 2025.4.6 and 2026.1.6.

AnalysisAI

Full admin account takeover in Pimcore (Studio backend) before 2025.4.6 and 2026.1.6 lets an unauthenticated attacker who knows a valid admin username hijack that account by submitting a password-reset request with an attacker-controlled resetPasswordUrl; the server appends a genuine recovery token to that URL and emails it to the victim, so a single victim click leaks the token to the attacker, who authenticates via POST /pimcore-studio/api/login/token with full admin rights and bypasses 2FA. GitHub advisory GHSA-h854-c3m3-mh5v classifies this as an authentication bypass (CWE-640). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.