THREAT OPS › Threat News › [GHSA] GHSA-f97c-ph8j-8vff (high) — Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
[GHSA] GHSA-f97c-ph8j-8vff (high) — Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
GHSA-f97c-ph8j-8vff Severity: high CVE: CVE-2026-55212
Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation
### Summary The Studio API class definition creation endpoint in `pimcore/studio-backend-bundle` is guarded by the `objects` permission instead of the `classes` permission, allowing any standard editor-level user to create class definitio
Indicators of compromise
- CVE-2026-55212cve
- https://your-pimcore/pimcore-studio/api/loginurl
- https://your-pimcore/pimcore-studio/api/class/definition/configuration-view/detail/createurl
Original source: https://github.com/advisories/GHSA-f97c-ph8j-8vff