CVE-2026-55207: Pimcore Admin Account Takeover via Password Reset Token Interception

Technical summary

The vulnerability stems from improper handling of the password reset mechanism in Pimcore's authentication flow. When a password reset is initiated, the application accepts an attacker-supplied resetPasswordUrl parameter and concatenates a cryptographically valid recovery token to it before sending the reset email. This design flaw means the token—which should only be known to the legitimate admin—is transmitted through an attacker-controlled domain. The token is then usable with the POST /pimcore-studio/api/login/token endpoint to authenticate as the targeted admin account. Critically, token-based login bypasses the two-factor authentication checks that would normally protect the account, allowing complete account takeover. The vulnerability affects Pimcore versions prior to 2025.4.6 and 2026.1.6.

Business impact

Successful exploitation grants attackers full administrative control over a Pimcore instance, enabling them to modify content, extract sensitive data, alter user accounts, deploy malware, or disrupt service availability. Because the attack bypasses multi-factor authentication, organizations that rely on 2FA as a primary security control are not protected. The social engineering requirement (convincing an admin to click a link) is a relatively low bar in many organizations, making this a practical attack vector. For data management and e-commerce platforms built on Pimcore, account takeover can have severe confidentiality, integrity, and availability implications.

Affected systems

Pimcore open-source instances running versions prior to 2025.4.6 (in the 2025.x branch) and prior to 2026.1.6 (in the 2026.x branch) are affected. Organizations should verify their installed version and check whether they have applied the relevant patch. Self-hosted and cloud-deployed Pimcore installations are equally vulnerable if not updated.

Exploitability

This vulnerability is highly exploitable. It requires only knowledge of a valid admin username (often discoverable via directory enumeration, public documentation, or social engineering) and a way to send a phishing email or message that convinces the admin to click a crafted password reset link. No authentication, complex network positioning, or zero-day exploit techniques are needed. The social engineering component is the primary barrier, but in many organizations, well-crafted phishing succeeds reliably. The CVSS 3.1 score of 8.8 (HIGH) reflects the combination of network accessibility, low attack complexity, and high impact across confidentiality, integrity, and availability.

Remediation

Apply patches immediately: upgrade to Pimcore 2025.4.6 or later for instances in the 2025.x branch, or to 2026.1.6 or later for instances in the 2026.x branch. The patches address the root cause by no longer accepting attacker-supplied resetPasswordUrl values and by ensuring tokens are not transmitted to untrusted domains. After patching, verify that password reset emails direct users to the legitimate Pimcore domain only. Additionally, review admin accounts for signs of unauthorized access or token abuse during the window before patching.

Patch guidance

Check your current Pimcore version by inspecting installation metadata or the admin panel. If running 2025.x versions, update to 2025.4.6 or later. If running 2026.x versions, update to 2026.1.6 or later. Follow your organization's standard change management process, including testing in a non-production environment first. No database migrations or configuration changes are expected, but verify compatibility notes in the official Pimcore release documentation before deploying to production.

Detection guidance

Monitor authentication logs and token generation events for unusual patterns: multiple failed login attempts followed by token-based authentication, logins from unexpected geographic locations or IP ranges, or token issuance events that do not correlate with user-initiated password resets. If available, inspect email gateway logs for password reset emails sent to suspicious external domains. Review admin account access logs for sessions initiated via token authentication during the pre-patch window. Implement alerting on any successful admin login that bypasses 2FA, as token-based authentication should be treated as a sensitive event.

Why prioritize this

This vulnerability should be prioritized for immediate patching due to the combination of high CVSS severity (8.8), complete lack of authentication requirement, and the practical exploitability via social engineering. Admin account compromise is a critical security incident, and the 2FA bypass eliminates a common compensating control. Organizations managing sensitive data or operating in regulated industries should treat this as an emergency patch.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and requirement for user interaction (UI:R—the admin must click the link). The impact is high across all three dimensions—confidentiality (access to admin data and platform content), integrity (ability to modify any data or configurations), and availability (ability to disable services or delete content). The primary limiting factor is the UI requirement, which prevents fully autonomous exploitation; however, that is not a significant practical limitation given the effectiveness of phishing campaigns.

Frequently asked questions