CVE-2026-108697
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers.
Risk Assessment
The risk is unauthorized disclosure of sensitive store configuration information, which may facilitate further attacks or breach data confidentiality.
Recommendation
Update CoreShop to a version that includes a fix restoring the isGrantedOr403() check in ResourceController listAction. Additionally, restrict access to list routes for unauthorized users.
Other vulnerabilities in CoreShop
See all- CVE-2026-108696Medium
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply another reshipId to SendReship to confirm receipt of others' orders and overwrite return tracking details.
- CVE-2026-41249High
CoreShop versions 5.0.1 through 5.1.0-beta.1 have a GitHub Actions workflow vulnerability allowing external attackers to achieve RCE by submitting a malicious Pull Request. The workflow uses `pull_request_target` and dangerously checks out code from the PR head.
- CVE-2026-22242Medium
CoreShop prior to version 4.1.8 contains a blind SQL injection vulnerability that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.
Original NVD description (English source)
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS