CVE-2026-45703: Pimcore has a WordExport Authorization Bypass for Unauthorized Document Export
(updated )
The WordExport export flow only checks whether the current backend user has the feature permission word_export. It does not verify access rights on the target element itself.
As a result, a low-privileged backend user can export document content even when the user does not have view permission on that document.
In the local Docker reproduction, a low-privileged user successfully exported sensitive content from a page the user was not allowed to view:
POC-WORDEXPORT-TITLEPOC-WORDEXPORT-DESC
References
- github.com/advisories/GHSA-332x-r494-54fq
- github.com/pimcore/pimcore/commit/0ce2232b6f92c79d0ac244e95e21f55c37456ef1
- github.com/pimcore/pimcore/pull/19112
- github.com/pimcore/pimcore/releases/tag/v12.3.7
- github.com/pimcore/pimcore/security/advisories/GHSA-332x-r494-54fq
- nvd.nist.gov/vuln/detail/CVE-2026-45703
Code Behaviors & Features
Detect and mitigate CVE-2026-45703 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →