CVE-2026-45703

6.4 Moyenne

Publiée le 17/07/2026 à 21:17 · Modifiée le 22/07/2026 à 22:50 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view. This issue is fixed in versions 11.5.17 (LTS) and 12.3.7.

Traduire en français

Produits concernés

pimcore

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.4 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L`

Faiblesses (CWE)

CWE-862

Références

https://github.com/pimcore/pimcore/releases/tag/v12.3.7
https://github.com/pimcore/pimcore/security/advisories/GHSA-332x-r494-54fq
https://github.com/pimcore/pimcore/security/advisories/GHSA-332x-r494-54fq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories