5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23496

CVE-2026-23496: Pimcore Web2Print Tools Bundle "Favourite Output Channel Configuration" Missing Function Level Authorization

Pimcore Web2Print Tools Bundle adds tools for web-to-print use cases to Pimcore. Prior to 5.2.2 and 6.1.1, the application fails to enforce proper server-side authorization checks on the API endpoint responsible for managing "Favourite Output Channel Configurations." Testing revealed that an authenticated backend user without explicitely lacking permissions for this feature was still able to successfully invoke the endpoint and modify or retrieve these configurations. This vulnerability is fixed in 5.2.2 and 6.1.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23496

CVE-2026-23496:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pimcore/web2print-tools-bundle	composer	>= 6.0.0-RC1, <= 6.1	6.1.1
pimcore/web2print-tools-bundle	composer	<= 5.2.1	5.2.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Broken Access Control issue within the AdminController.php of the pimcore/web2print-tools-bundle. The analysis of the associated pull request (#108) and its commits reveals that multiple controller actions related to "Favourite Output Channel Configurations" were missing server-side authorization checks. The initial fixing commit (e73e12c340514d9129e40ba60624825b6e12bf1b) attempted to add a permission check ($this->checkPermission(...)) to three functions: favoriteOutputDefinitionsTableProxyAction, favoriteOutputDefinitionsAction, and saveOrUpdateFavoriteOutputDefinitionAction. This aligns with the vulnerability description, which states that unauthorized users could list, create, and update these configurations. Although the final patch (7714452a04b9f9b077752784af4b8d0b05e464a1) only kept the check in favoriteOutputDefinitionsTableProxyAction, the initial broader fix indicates that all three functions were indeed vulnerable. The root cause was the failure to validate user permissions on the backend, allowing any authenticated user to call these API endpoints and perform privileged actions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.