High severity · published Jul 17, 2026
CVE-2026-45704
Pimcore: CustomReports Share Bypass
7.1
CVSS
0.4%
EPSS
No
On KEV
Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with the reports permission to directly request an unshared report such as poc-secret-report by name and read report name, grouping information, display and icon metadata, data source configuration, column configuration, and sharing settings even when shareGlobally is false. This issue is fixed in versions 11.5.17 (LTS) and 12.3.6.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
pimcore · pimcore
< 11.5.17; >= 12.0.0, < 12.3.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45704
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45704
github.com
https://github.com/pimcore/pimcore/commit/1893ff1cd116e442b995ddf17e8c6e0aa372268e
github.com
https://github.com/pimcore/pimcore/pull/19099
github.com
https://github.com/pimcore/pimcore/releases/tag/v12.3.6
github.com
https://github.com/pimcore/pimcore/security/advisories/GHSA-jwcc-gv4m-93x6
More from pimcore
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
9.8
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
9.8
CVE-2019-18985
Pimcore before 6.2.2 lacks brute force protection for the 2FA token
9.8
CVE-2019-18981
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column