CVE-2026-55212: Pimcore Studio API Privilege Escalation in Class Definition Creation

Technical summary

The Studio API endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create validates against the 'objects' permission rather than the 'classes' permission required for class definition creation. This permission bypass allows standard editor-level users (PR:L in CVSS terms) to reach functionality that generates database schema changes and server-side PHP class files. Additionally, the API layer lacks proper UID format validation, permitting malformed UIDs to propagate to the model layer where they trigger internal exceptions. The vulnerability is network-accessible (AV:N), requires low attack complexity (AC:L), and results in modified class definitions that persist on the system (I:H). Confidentiality impact is low (C:L), as internal error messages may leak system details; there is no availability impact (A:N).

Business impact

Successful exploitation enables unauthorized users to alter the core data schema of a Pimcore instance. This can lead to data corruption, application instability, or injection of malicious data structures. In multi-tenant or shared environments, a compromised editor account could degrade service for all users. The ability to create arbitrary PHP classes and database tables introduces risk of code execution if those definitions are later instantiated or processed in unsafe ways. For organizations using Pimcore in production, this represents an insider threat vector and a potential stepping stone to further system compromise.

Affected systems

All Pimcore versions prior to 2025.4.6 and 2026.1.6 are vulnerable. The vulnerability is present in both the 2025.x and 2026.x release branches. Organizations running Pimcore in any configuration—self-hosted, containerized, or cloud-deployed—are affected if they have not applied the patched versions. The attack surface is limited to authenticated users with editor-level permissions or higher, but in environments with many editors or weak access controls, exposure is elevated.

Exploitability

Exploitation requires valid authentication credentials with at least editor-level permissions. An attacker cannot exploit this vulnerability from the internet without first compromising or being granted a legitimate user account. The CVSS vector reflects this requirement (PR:L). However, within an organization, the barrier is low: any editor account—typically numerous in a content management context—can trigger the vulnerability with a single POST request to a known API endpoint. No user interaction is required, and the attack is repeatable. The lack of API-layer UID validation may allow attackers to probe system behavior through crafted requests, though the immediate impact is schema modification rather than code execution.

Remediation

Organizations must upgrade to Pimcore 2025.4.6 or 2026.1.6 or later. The patches correct the permission check to validate against 'classes' permission and add API-layer UID format validation. Before patching, access to the Studio API should be restricted at the network or application level if possible. Review and audit user permission assignments to ensure that editor accounts have only the minimum necessary privileges. Monitor API logs for unusual POST requests to the /pimcore-studio/api/class/definition/ endpoints.

Patch guidance

Apply Pimcore version 2025.4.6 or 2026.1.6 immediately, depending on which release line your deployment uses. These versions include the permission validation fix and UID format validation. Test patches in a staging environment to verify compatibility with custom extensions before production deployment. If you are on a version between 2025.4.6 and 2026.1.6, ensure you are on the latest patch of your minor version; verify against the vendor advisory for the exact version that addresses this CVE.

Detection guidance

Monitor API access logs for POST requests to /pimcore-studio/api/class/definition/configuration-view/detail/create from user accounts with editor-level permissions. Look for requests with unusual or malformed UID parameters that may indicate probing. Track class definition creation events in Pimcore's audit logs; unexpected class definitions appearing outside normal change management workflows warrant investigation. Intrusion detection systems can flag repeated API calls to this endpoint or calls from unusual source IPs. In the short term, rate-limit or block this endpoint at the firewall if the Studio API is not in active use.

Why prioritize this

This vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) and merits immediate attention. While exploitation requires authentication, the privilege escalation is clear and the impact—unauthorized schema modification—is significant in a CMS context. The vulnerability has been public since July 2026, making it a known target for attackers. Any Pimcore instance exposed to a network with potentially compromised editor credentials is at risk. Prioritize patching of externally facing Pimcore deployments and instances with large numbers of editor users.

Risk score, explained

The CVSS 7.1 score reflects: network accessibility (AV:N) increasing exposure; low attack complexity (AC:L) since a single API call suffices; the requirement for low privileges (PR:L) limiting but not eliminating risk in typical deployments; high integrity impact (I:H) from unauthorized schema and code generation; and low confidentiality impact (C:L) from internal exception messages. The lack of availability impact (A:N) prevents a higher score, but the privilege escalation and integrity violations justify HIGH severity. Risk is elevated in organizations with weak access controls or high editor-to-admin ratios.

Frequently asked questions