Detections
Analytics

SCA: security update for pimcore/pimcore (GHSA-jwcc-gv4m-93x6)

high Tenable Self-Hosted Container Security Plugin ID 442411

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6,
 CustomReports uses inconsistent authorization between the report listing endpoint and the report detail
 endpoint in bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php and
 bundles/CustomReportsBundle/src/Tool/Config/Listing/Dao.php, allowing a low-privileged backend user with
 the reports permission to directly request an unshared report such as poc-secret-report by name and read
 report name, grouping information, display and icon metadata, data source configuration, column
 configuration, and sharing settings even when shareGlobally is false. This issue is fixed in versions
 11.5.17 (LTS) and 12.3.6. (CVE-2026-45704)

Solution

Update the pimcore/pimcore library and its related packages to version 12.3.6 or later.

See Also

https://github.com/advisories/GHSA-jwcc-gv4m-93x6

Plugin Details

Severity: High

ID: 442411

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/28/2026

Updated: 7/20/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.78

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-45704

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.1

Threat Score: 5

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/27/2026

Vulnerability Publication Date: 5/27/2026

Reference Information

CVE: CVE-2026-45704

cwe: CWE-863