PatchSiren cyber security CVE debrief
CVE-2026-45703 pimcore CVE debrief
CVE-2026-45703 is a security vulnerability in Pimcore's WordExport export flow. Prior to versions 11.5.17 (LTS) and 12.3.7, a low-privileged backend user could export document content they were not allowed to view due to insufficient permission checks. This vulnerability has a CVSS score of 6.4 and is classified as MEDIUM severity. The vulnerability is caused by the WordExport export flow not properly enforcing view permissions on page, snippet, email, or object elements.
- Vendor
- pimcore
- Product
- Unknown
- CVSS
- MEDIUM 6.4
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-17
- Original CVE updated
- 2026-07-17
- Advisory published
- 2026-07-17
- Advisory updated
- 2026-07-17
Who should care
Users of Pimcore, especially those with low-privileged backend access, should be aware of this vulnerability and take steps to update to a patched version. This includes reviewing and adjusting user permissions in the Pimcore backend and monitoring for any suspicious export activity.
Technical summary
The WordExport export flow in Pimcore's bundles/WordExportBundle/src/Controller/TranslationController.php did not properly enforce view permissions on page, snippet, email, or object elements. This allowed low-privileged backend users to export content they were not authorized to view. The vulnerability has a CVSS score of 6.4 and is classified as MEDIUM severity. Affected Pimcore users, especially those with low-privileged backend access, should review and adjust user permissions in the Pimcore backend and monitor for any suspicious export activity. The CVE record was published on 2026-07-17T19:17:14.790Z and last modified on 2026-07-17T20:17:17.633Z. The NVD entry is currently in the 'Received' status.
Defensive priority
Medium priority due to the CVSS score of 6.4 and the potential for data exposure.
Recommended defensive actions
- Update Pimcore to version 11.5.17 (LTS) or 12.3.7
- Review and adjust user permissions in the Pimcore backend
- Monitor for any suspicious export activity
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record was published on 2026-07-17T19:17:14.790Z and last modified on 2026-07-17T20:17:17.633Z. The NVD entry is currently in the 'Received' status. The vulnerability affects Pimcore's WordExport export flow, allowing low-privileged backend users to export document content they are not authorized to view. Evidence is limited to CVE and NVD details, with no additional information available.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-17T19:17:14.790Z and has not been modified since then. The NVD entry is currently Received.