Medium severity · published Jan 15, 2026
CVE-2026-23496
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This vulnerability is fixed in 5.2.2 and 6.1.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
pimcore · pimcore
>= 6.0.0-RC1, < 6.1.1; < 5.2.2 · source: vendor
WT
Web2print Tools · Pimcore
before 5.2.2; 6.0.0 before 6.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23496
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23496
Exploit
https://github.com/pimcore/pimcore/security/advisories/GHSA-4wg4-p27p-5q2r
Patch
https://github.com/pimcore/web2print-tools/commit/7714452a04b9f9b077752784af4b8d0b05e464a1
Exploit
https://github.com/pimcore/web2print-tools/pull/108
Release Notes
https://github.com/pimcore/web2print-tools/releases/tag/v5.2.2
Release Notes
https://github.com/pimcore/web2print-tools/releases/tag/v6.1.1
More from pimcore
9.9
CVE-2026-55634
Pimcore: Remote Code Execution via DataObject Class-Definition Field Name
9.8
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
9.8
CVE-2019-18985
Pimcore before 6.2.2 lacks brute force protection for the 2FA token
9.8
CVE-2019-18981
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification
9.3
CVE-2026-55220
Pimcore Hotspotimage getDataFromResource() unrestricted Serialize::unserialize over object-store column