PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55212 pimcore CVE debrief

The Pimcore Studio API class definition creation endpoint has a permission issue. Prior to versions 2025.4.6 and 2026.1.6, the endpoint is guarded by object permission instead of class permission. This allows a standard editor-level user to create class definitions without admin privileges, potentially leading to unauthorized database table and PHP class file creation. The vulnerability exists due to incorrect permission checks, allowing low-privileged users to create class definitions.

Vendor
pimcore
Product
Unknown
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-09
Original CVE updated
2026-07-10
Advisory published
2026-07-09
Advisory updated
2026-07-10

Who should care

Administrators and users of Pimcore, especially those with editor-level access, should be aware of this vulnerability and take steps to ensure their systems are updated to the latest versions. Pimcore operators should review deployment versions, assess exposure, and apply updates or mitigations. Vulnerability management and security teams should track this issue and verify Pimcore deployments.

Technical summary

The vulnerability exists in the Pimcore Studio API class definition creation endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create. It is guarded by object permission instead of class permission, allowing standard editor-level users to create class definitions without admin privileges. This could lead to the creation of new database tables and PHP class files on the server. Additionally, missing API-layer UID format validation allows malformed UIDs to reach model-layer validation, potentially returning internal exceptions.

Defensive priority

High

Recommended defensive actions

  • Update Pimcore to version 2025.4.6 or 2026.1.6
  • Restrict access to the class definition creation endpoint
  • Monitor for suspicious class definition creation activity
  • Implement additional validation for UIDs
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-09T21:16:56.150Z and was last modified on 2026-07-10T15:52:52.497Z. The NVD entry is currently Deferred. Evidence limits suggest that Pimcore versions prior to 2025.4.6 and 2026.1.6 are likely affected. Defenders should verify Pimcore deployment versions and review class definition creation permissions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55212 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55212

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55212 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55212

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.