CVE-2026-55212

🗓️ 09 Jul 2026 20:53:36Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 49 Views🌐 WEB

Pimcore permits editors to create class definitions due to a permission flaw and UID validation weaknesses; fixed in 2025.4.6 and 2026.1.6.

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2026-55212	9 Jul 202620:53	–	attackerkb
Circl	CVE-2026-55212	28 Aug 202620:35	–	circl
Cvelist	CVE-2026-55212 Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation	9 Jul 202620:53	–	cvelist
EUVD	EUVD-2026-42695	28 Aug 202619:05	–	euvd
Github Security Blog	Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation	28 Aug 202619:05	–	github
Mend	CVE-2026-55212	9 Jul 202620:53	–	mend
NVD	CVE-2026-55212	9 Jul 202621:16	–	nvd
osv_ghsa	GHSA-F97C-PH8J-8VFF Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation	28 Aug 202619:05	–	osv_ghsa
Positive Technologies	PT-2026-56935	9 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-55212: Improper Authorization	9 Jul 202600:00	–	rapid7

Vulners

Node

pimcore pimcoreRange2026.1.0–2026.1.6

pimcore pimcoreRange<2025.4.6

[
  {
    "vendor": "pimcore",
    "product": "pimcore",
    "versions": [
      {
        "version": ">= 2026.1.0, < 2026.1.6",
        "status": "affected"
      },
      {
        "version": "< 2025.4.6",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6
github	www.github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6
github	www.github.com/pimcore/pimcore/security/advisories/GHSA-f97c-ph8j-8vff
github	www.github.com/pimcore/studio-backend-bundle/pull/1886
github	www.github.com/pimcore/studio-backend-bundle/commit/d1a4788c0f159c360d550c34256c8abbbd633ae0

Parameter	Position	Path	Description	CWE
UID	request body	/pimcore-studio/api/class/definition/configuration-view/detail/create	The endpoint allows standard editor-level users to create class definitions (which generate database tables and PHP files) due to incorrect permission checks. It also lacks UID format validation, potentially leading to internal exceptions.	CWE-285

10 Jul 2026 21:16Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.1

EPSS0.00351

SSVC

CWE-285