pimcore/web2print-tools-bundle
Web-to-print Tools community bundle adds some additional tools for web-to-print use cases to Pimcore.
View on Github
Activity
- Latest release
- Jan 13, 2026
- Total releases
- 59
- Cadence
- ~41 days
- Last 12 months
- 3
Reach
- Stars
- 16
Details
- License
- custom
- First release
- Jun 06, 2016
| Version | Released | |
|---|---|---|
v6.1.1
patch
| ||
v5.2.2
patch
| ||
v6.1.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v6.0.0
major
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v6.0.0-RC1
pre
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.2.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.2.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.1.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.1.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.2
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.0
major
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.0-RC2
pre
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.10
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.0-RC1
pre
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.0-BETA2
pre
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v5.0.0-BETA1
pre
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.9
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.8
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.7
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.6
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.5
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.4
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.3
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.2
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v4.0.0
major
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.4.4
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.4.3
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.4.2
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.4.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.4.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.3.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.3.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.2.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.2.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.1.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.1.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v3.0.0
major
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.7.2
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.7.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.7.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.6.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.5.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.4.1
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.4.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.3.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.2.3
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.2.2
patch
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v2.2.0
minor
1 CVE
CVE-2026-23496
GHSA-4wg4-p27p-5q2r
Jan 15, 2026
Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization
5.4
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
Low
None
SummaryThe application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This violates the principle of least privilege and constitutes a classic example of Broken Access Control (OWASP Top 10 A01:2021). Because authorization is not validated at the function level, any authenticated user can perform actions intended only for privileged roles, leading to horizontal or vertical privilege escalation. DetailThe backend user without permission was still able to list, create, update "Favourite Output Channel Configuration" item Step to Reproduce the issuelogin as Admin (full permission) and clicked "Favourite Output Channel Configurations" Then, captured and saved the request: -List API -Create API -Update API Next, login a backend user with no permission The copy the "Cookie" and "X-Pimcore-Csrf-Token" After that, pasted the copied "Cookie" and "X-Pimcore-Csrf-Token" to captured request
ImpactSuccessful exploitation allows low-privileged or standard users to view, create, modify that should be restricted to specific administrative or operational roles. Depending on the sensitivity of these configurations (e.g., routing of alerts, reports, or data streams), an attacker could redirect critical outputs, suppress notifications, insert misleading channels, or gain insight into internal workflows. In regulated environments, this may result in compliance violations, operational disruption, or facilitation of further attacks through reconnaissance. Affected versions
v6.0.0
v6.0.0-RC1
v6.1.0
1.0.0
1.0.1
1.0.2
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
+ 48 more Show less
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.6.0
v2.7.0
v2.7.1
v2.7.2
v3.0.0
v3.1.0
v3.1.1
v3.2.0
v3.2.1
v3.3.0
v3.3.1
v3.4.0
v3.4.1
v3.4.2
v3.4.3
v3.4.4
v4.0.0
v4.0.1
v4.0.10
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v5.0.0
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.0.0-RC2
v5.0.1
v5.0.2
v5.1.0
v5.1.1
v5.2.0
v5.2.0-RC1
v5.2.1
Fixed in
5.2.2
6.1.1
References
Updated Feb 03, 2026 · Source: OSV.dev |