CVE-2026-108697
Last modified
CVE-2026-108697 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers..
Description
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| CoreShop | CoreShop | <= 2026.2.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-108697?
How severe is CVE-2026-108697?
How do I fix CVE-2026-108697?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-108691mall4j through 4.0 contains an improper authorization vulner…5.4
- CVE-2026-1086921Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a miss…6.5
- CVE-2026-108693ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contai…7
- CVE-2026-108694ConvertX through 0.19.0 contains an arbitrary file read vuln…6.5
- CVE-2026-108695MultiVendorX WordPress plugin through 5.0.19 contains an inc…7.1
- CVE-2026-108696CoreShop through 1.5.5 contains an authorization bypass vuln…4.3
- CVE-2026-108698hyper-mcp through 0.8.3 contains a signature verification by…6.5
- CVE-2026-108699hyper-mcp through 0.8.3 contains an improper signature verif…6.5
- CVE-2026-1087The Guardian News Feed plugin for WordPress is vulnerable to…4.3
- CVE-2026-10870A flaw has been found in Shibby Tomato 1.28.0000. This affec…7.3
- CVE-2026-1087001Panel-dev CordysCRM before 1.9.2 contains a missing authori…6.5
- CVE-2026-1087011Panel-dev CordysCRM before 1.9.2 contains a missing authori…4.3
Are you affected by CVE-2026-108697?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST