CVE-2026-108697 CoreShop CVE debrief

Who should care

Defenders responsible for CoreShop deployments, particularly those with low-privileged backend users, should assess their exposure to this vulnerability. They should verify the presence of this issue in their inventory and implement necessary controls to prevent unauthorized access to resources.

Why it matters

CVE-2026-108697 is a missing authorization vulnerability in CoreShop through version 2026.2.2 that allows low-privileged users to enumerate restricted resources. Defenders should verify the presence of this vulnerability, assess exposure, and implement controls to prevent unauthorized access.

• Defenders need to verify the presence of this vulnerability in their CoreShop deployments to prevent unauthorized resource enumeration.
• Low-privileged backend users may be able to list restricted resources, potentially leading to information disclosure.
• Implementing compensating controls, such as restricting access to the ResourceController listAction, is necessary to prevent exploitation.
• Monitoring for unauthorized access attempts and implementing additional logging can help detect potential exploitation.

Technical summary

The vulnerability is caused by the ResourceController listAction in CoreShop through version 2026.2.2 not properly checking for authorization. This allows low-privileged backend users to list permission-restricted resources, including payment providers, carriers, price rules, stores, and tax rules. The issue arises from the lack of isGrantedOr403() check, enabling authenticated Pimcore users without resource permissions to enumerate these resources. Defenders should verify the presence of this vulnerability in their inventory and assess the exposure of their systems, particularly those with low-privileged backend users.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their inventory and assess the exposure of their systems, particularly those with low-privileged backend users. They should also monitor for any unauthorized access to resources and implement compensating controls if necessary.

Recommended defensive actions

• Verify the presence of CoreShop version 2026.2.2 or earlier in your inventory.
• Assess the exposure of your systems, particularly those with low-privileged backend users.
• Monitor for unauthorized access to resources and implement compensating controls if necessary.
• Restrict access to the ResourceController listAction for low-privileged users.
• Implement additional logging and monitoring to detect potential exploitation attempts.

Evidence notes

The vulnerability is confirmed in CoreShop through version 2026.2.2. The issue is related to the ResourceController listAction not performing the required authorization check. Authenticated users lacking permissions can exploit this to list restricted resources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.