A missing authorization vulnerability in CoreShop through version 2026.2.2 allows low-privileged backend users to list permission-restricted resources. This issue arises from the ResourceController listAction skipping the isGrantedOr403() check, enabling authenticated Pimcore users without resource permissions to enumerate payment providers, carriers, price rules, stores, and tax rules, including their id [truncated]
CVE-2026-41249 is a high-severity vulnerability in CoreShop, a Pimcore enhanced eCommerce solution. The vulnerability allows for Remote Code Execution (RCE) via a malicious Pull Request. CoreShop versions 5.0.1 through 5.1.0-beta.1 are affected. The GitHub Actions workflow (.github/workflows/static.yml) uses the pull_request_target trigger but dangerously checks out the unverified code from the pull reque [truncated]
CVE-2026-22242 is a blind SQL injection vulnerability in CoreShop, a Pimcore enhanced eCommerce solution. The vulnerability allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. The vulnerability has been patched [truncated]
