Pimcore Studio Backend Bundle Privilege Escalation via Insufficient Permission Check on Class Definition Creation

Vulnerability Overview Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation Vulnerability Description: The class definition creation endpoint in the Pimcore API ( ) is protected by the permission instead of the permission. This allows any user with standard editor-level privileges to create class definitions without administrator rights. Class definition creation is a structural administrative operation, equivalent to schema modification, which creates new database tables and PHP class files on the server. Furthermore, the API layer does not perform format validation on the UID field before passing data to the model layer, relying solely on downstream validation present in the model layer ( ). Impact Scope Affected Versions: 2026.1.x Fixed Versions: 2025.4.6, 2026.1.6 Severity: High CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: High - Availability: None Remediation 1. Issue 1: Incorrect Permission Guard on CreateController - Current Code: - Correct Code: 2. Issue 2: Missing UID Format Validation in API Layer - Current Code: - Fixed Code: POC Code Prerequisites Pimcore 2026.1.x with Studio API enabled User has only permissions, without permissions Step 1: Authenticate as an editor user Step 2: Confirm that the user lacks class management access in Classic Admin Log in to Classic Admin as . Verify that the "Classes" menu is not visible and the user cannot access Settings > Classes. This confirms that permissions have not been granted. Step 3: Create a class definition via Studio API despite lacking permissions Impact Any authenticated Pimcore user with standard permissions can create class definitions via the Studio API, bypassing the permission restrictions enforced in Classic Admin. This constitutes a privilege escalation from editor-level capabilities to administrator-level capabilities. Class definition creation generates new database tables and PHP class files on the server, granting unauthorized users the ability to modify the application schema, introduce malformed class structures, and trigger downstream processing beyond their permitted scope. The absence of UID validation at the API layer exacerbates the issue by allowing malformed UIDs to reach the model layer, resulting in unhandled external exceptions that may expose stack traces depending on the server's debug configuration. Authentication required for attacker: Yes - Valid Pimcore session with permissions required Authentication required for victim: No - No victim interaction required Accessible content: Full class definition creation functionality, including database table generation and PHP class file creation on the server

Goal Reached Thanks to every supporter — we hit 100%!

Pimcore Studio Backend Bundle Privilege Escalation via Insufficient Permission Check on Class Definition Creation

More from this source