Summary CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint. The listing flow filters reports based on report-sharing rules The detail flow only checks generi…
| CVE ID | CVE-2026-45704 |
| Vendor | composer |
| Affected Product | pimcore/pimcore |
| Vulnerability Type | Vulnerability |
| CVSS Score | 7.5 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint. - The listing flow filters reports based on report-sharing rulesreports or reports_config permissions As a result, a low-privileged backend user who was not granted access to a report can still read that report directly by name even though it does not appear in the user's visible report list. In the local Docker reproduction: - The report poc-secret-report was not visible to the low-privileged user in the report listgetReportConfigAction() filters reports through loadForGivenUser(): - [[CustomRepoSigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.