Pimcore Unauthenticated Account Takeover via Password Reset URL Injection and 2FA Bypass

github.com 2026-07-10查看中文 →

Security AdvisoryHighPimcore

Affected:

Pimcore <= 2026.1

Fixed in:

2025.4.6
2026.1.6

Referenced CVEs: CVE-2026-55207 · 8.8

文章内图片已隐藏以节省流量 · Upgrade to Pro to view images & offline archive

This content was auto-fetched from github.com, cleaned by our LLM pipeline, and translated to English. View original.

More from this source

Snipe-IT v6.3.0 Multi-Company Scope Check Fix 2026-07-11 Markdown Renderer XSS Fix: Strict Control of html_input and allow_unsafe_links Parameters 2026-07-11 CVE-2024-54329: Cross-Tenant Accessory Injection in Snipe-IT API 2026-07-11 IDOR in laravel-crm Bouncer middleware: unauthorized edit/delete/reassign of records 2026-07-11 Multi-tenant IDOR Fix: Enforcing company_id Scoping in Controllers 2026-07-11

Offline Archive

Offline screenshot & PDF are Pro-exclusive