Vulnerability · Published Jan 15, 2026 · Assigned by GitHub_M

CVE-2026-23496Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization

Medium 5.4

In plain English

A medium-severity improper access control in pimcore from pimcore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 78.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This vulnerability is fixed in 5.2.2 and 6.1.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	pimcore/web2print-tools-bundle	6.1.1	GHSA-4wg4-p27p-5q2r
Packagist	pimcore/web2print-tools-bundle	5.2.2	GHSA-4wg4-p27p-5q2r

Affected products (as reported)

Vendor	Product	Versions
pimcore	pimcore	>= 6.0.0-RC1, < 6.1.1< 5.2.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r x_refsource_CONFIRM
https://github.com/pimcore/web2print-tools/pull/108 x_refsource_MISC
https://github.com/pimcore/web2print-tools/commit/7714452a04b9f9b077752784af4b8d0b05e464a1 x_refsource_MISC
https://github.com/pimcore/web2print-tools/releases/tag/v5.2.2 x_refsource_MISC
https://github.com/pimcore/web2print-tools/releases/tag/v6.1.1 x_refsource_MISC