What is the CVSS score of CVE-2026-55212?

CVE-2026-55212 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Pimcore are affected by CVE-2026-55212?

Pimcore's Studio API (CVE-2026-55212) contains a broken authorization flaw that allows standard editor-level users to create class definitions and database tables without administrative privileges.. A patch is available.

Is there a public PoC exploit available for CVE-2026-55212?

Yes, a public proof-of-concept exploit is available for CVE-2026-55212. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-55212?

24 hours: Inventory all Pimcore deployments and identify current versions; list users with editor or equivalent roles. 7 days: Upgrade to Pimcore 2025.4.6 or 2026.1.6 (or later); deploy upgrades to lower environments first and validate application functionality post-deployment. 30 days: Audit API access logs for the /pimcore-studio/api/class/definition endpoint; identify and review all class definitions created by non-administrative users during the exposure window; document findings for compliance audit trail.

Pimcore CVE-2026-55212

EUVD-2026-42695 HIGH

Improper Authorization (CWE-285)

2026-07-09 security-advisories@github.com

GHSA-f97c-ph8j-8vff

PHP Authentication Bypass

7.1

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

7.1 HIGH

Network-reachable API with low complexity and no user interaction, but a valid editor account is required (PR:L); high integrity from schema/file creation, low confidentiality from exception leakage, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 09, 2026 - 22:01 EUVD

Analysis Generated

Jul 09, 2026 - 21:41 vuln.today

DescriptionCVE.org

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create is guarded by the objects permission instead of the classes permission, allowing a standard editor-level user to create class definitions without admin privileges. Class definition creation generates new database tables and PHP class files on the server, and missing API-layer UID format validation allows malformed UIDs to reach model-layer validation and return internal exceptions. This issue is fixed in versions 2025.4.6 and 2026.1.6.

AnalysisAI

Broken authorization in Pimcore's Studio API lets a standard editor-level user create class definitions without administrative rights, because the POST /pimcore-studio/api/class/definition/configuration-view/detail/create endpoint checks the 'objects' permission rather than the 'classes' permission. Because class-definition creation writes new database tables and PHP class files to the server, this permission gap grants low-privileged users significant control over the application's data model and codebase, and absent API-layer UID validation malformed UIDs reach model-layer validation and surface internal exceptions. No public exploit identified at time of analysis; the flaw is fixed in 2025.4.6 and 2026.1.6.

Technical ContextAI

Pimcore is a PHP-based open-source Data & Experience Management Platform (PIM/DXP) whose 'Studio' backend bundle exposes a REST API for administering the object model. In Pimcore, class definitions are schema-level artifacts: creating one dynamically generates backing database tables and auto-generated PHP class files on the server filesystem, so the ability to create them is normally reserved for administrators via the dedicated 'classes' permission. The root cause maps to CWE-285 (Improper Authorization): the create endpoint was wired to the 'objects' permission - the routine content-editing capability every editor holds - instead of the privileged 'classes' permission, collapsing an admin-only operation to editor scope. A secondary weakness is a missing API-layer input validation step on the UID format, which lets malformed UIDs pass through to model-layer validation and produce internal exceptions rather than being rejected cleanly at the boundary.

RemediationAI

Vendor-released patch: upgrade the Pimcore studio-backend-bundle to 2025.4.6 (https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6) if on the 2025.x line, or to 2026.1.6 (https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6) if on the 2026.x line; the corrective change is tracked in PR #1886 and commit d1a4788c0f159c360d550c34256c8abbbd633ae0, and details are in advisory GHSA-f97c-ph8j-8vff. If immediate patching is not possible, the practical compensating control is to tightly restrict which accounts hold editor-level access and audit the user/role list, since exploitation depends on holding an editor session; where feasible, block or restrict access to the POST /pimcore-studio/api/class/definition/configuration-view/detail/create endpoint at a reverse proxy or WAF for non-administrative users, accepting the side effect that any legitimate non-admin workflow touching that route will break. Also monitor for unexpected new class definitions, database tables, or generated PHP class files as a detective control. These mitigations reduce but do not eliminate exposure and are inferior to applying the fixed release.