[HIGH] Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

PKSA-89fg-v2s3-x29j CVE-2026-55212 GHSA-f97c-ph8j-8vff

Affected version: >=2026.1.0,<2026.1.6|<2025.4.6

Reported by:
GitHub

[HIGH] Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract arbitrary database data including admin password hashes

PKSA-pq1q-v29r-6xp5 CVE-2026-55208 GHSA-79cw-hfcc-7mw9

Affected version: >=2026.1.0,<2026.1.6|<2025.4.6

Reported by:
GitHub

[HIGH] Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

PKSA-spw3-r32w-35m6 CVE-2026-55207 GHSA-h854-c3m3-mh5v

Affected version: >=2026.1.0,<2026.1.6|<2025.4.6

Reported by:
GitHub