CyberRota Analysis
AI-GeneratedPimcore versions prior to 2025.4.6 and 2026.1.6 are vulnerable to an account takeover attack, where an unauthenticated attacker can exploit a flaw in the password reset mechanism by using a crafted resetPasswordUrl to gain access to any admin account. This vulnerability allows the attacker to authenticate with full admin privileges, bypassing two-factor authentication, which poses a significant risk to the integrity and security of the platform. Organizations using affected versions should prioritize immediate updates to mitigate this high-severity threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used with POST /pimcore-studio/api/login/token to authenticate with full admin privileges while bypassing two-factor authentication. This issue is fixed in versions 2025.4.6 and 2026.1.6.