CVE-2026-23494: Pimcore is Missing Function Level Authorization on "Static Routes" Listing

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-01-15 · updated 2026-06-17
Weakness: CWE-284

Description

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for reading or listing static routes. In Pimcore, static routes are custom URL patterns defined via the backend interface or the var/config/staticroutes.php file, including details like regex-based patterns, controllers, variables, and priorities. These routes are registered automatically through the PimcoreStaticRoutesBundle and integrated into the MVC routing system. Testing revealed that an authenticated backend user lacking explicit permissions was able to invoke the endpoint (e.g., GET /api/static-routes) and retrieve sensitive route configurations. This vulnerability is fixed in 12.3.1 and 11.5.14.

Affected products

pimcore/pimcore: before 11.5.14; from 12.0.0 before 12.3.1 — fixed in 11.5.14, 12.3.1

How to fix

Upgrade to a fixed version: pimcore/pimcore 11.5.14, 12.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23494 or the next vulnerability affects your stack