CVE-2026-108697: CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
CoreShop deployments through 2026.2.2 are affected where authenticated Pimcore backend users exist, including users that do not have permission to access the affected resources. The issue concerns generated list routes for payment providers, carriers, price rules, stores, and tax rules.
What does an attacker need to exploit it?
An attacker needs valid authentication as a low-privileged Pimcore backend user. No user interaction is required, and the attacker can request generated list routes despite lacking the relevant resource permissions.
What information can be disclosed?
Unauthorized users can enumerate affected resources and obtain their IDs, names, and identifiers. The provided data does not indicate modification, deletion, or availability impact.
How can teams determine whether they are affected?
Check whether CoreShop is deployed at version 2026.2.2 or earlier and whether low-privileged backend users can access generated list routes for the affected resource types. The vulnerable behavior is the absence of the isGrantedOr403() authorization check in ResourceController listAction.