CVE-2026-55207
1 advisory.
Packagist/pimcore/studio-backend-bundle CVE-2026-55207: high 8.8, EPSS 0.67%
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
Action: Upgrade pimcore/studio-backend-bundle to 2025.4.6 or later.
composer require pimcore/studio-backend-bundle:2025.4.6composer require pimcore/studio-backend-bundle:2026.1.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2025.4.6 | - |
| 2026.1.0 | 2026.1.6 | - |
Fixed versions
| 2025.4.6 | 2026.1.6 |
Sources
- osv: GHSA-h854-c3m3-mh5v
- https://github.com/pimcore/pimcore/security/advisories/GHSA-h854-c3m3-mh5v
- https://nvd.nist.gov/vuln/detail/CVE-2026-55207
- https://github.com/pimcore/studio-backend-bundle/pull/1882
- https://github.com/pimcore/studio-backend-bundle/commit/ea9d329686f5e5aea2eec378d63ac2deb965bb27
- https://github.com/pimcore/pimcore
- https://github.com/pimcore/studio-backend-bundle/releases/tag/v2025.4.6
- https://github.com/pimcore/studio-backend-bundle/releases/tag/v2026.1.6
CVE-2026-55207 · published · modified · JSON