{"cve":"CVE-2026-23495","nvd":{"published":"2026-01-15T17:16:08.597","modified":"2026-06-17T10:21:41.493","status":"Analyzed","description":"Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Prior to 2.2.3 and 1.7.16, the API endpoint for listing Predefined Properties in the Pimcore platform lacks adequate server-side authorization checks. Predefined Properties are configurable metadata definitions (e.g., name, key, type, default value) used across documents, assets, and objects to standardize custom attributes and improve editorial workflows, as documented in Pimcore's official properties guide. Testing confirmed that an authenticated backend user without explicit permissions for property management could successfully call the endpoint and retrieve the complete list of these configurations. The vulnerability is fixed in 2.2.3 and 1.7.16.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-284"],"references":["https://github.com/pimcore/admin-ui-classic-bundle/commit/98095949fbeaf11cdf4cadb2989d7454e1b88909","https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v1.7.16","https://github.com/pimcore/admin-ui-classic-bundle/releases/tag/v2.2.3","https://github.com/pimcore/pimcore/security/advisories/GHSA-hqrp-m84v-2m2f"],"products":["pimcore:admin_classic_bundle"],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2026-23495","score":0.0036,"percentile":0.29787,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}