CVE-2026-108697

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108697
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108697.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108697
Published
2026-10-11T13:25:58Z
Modified
2026-10-14T02:30:56Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction
Details

CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108697.json"
}
References

Affected packages

Git / github.com/coreshop/coreshop

Affected ranges

Type
GIT
Repo
https://github.com/coreshop/coreshop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a9c3fcefa0e79b83bcb9aa48234cbd9637c5f19d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "2026.2.2"
        },
        {
            "fixed":  "2026.2.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.5
1.0.6
1.0RC1
1.0RC2
1.0RC3
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
2.*
2.0.0
2.0.0-RC.1
2.0.0-RC.2
2.0.0-alpha.1
2.0.0-alpha.2
2.0.0-alpha.3
2.0.0-alpha.4
2.0.0-alpha.5
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
2.0.0-beta.4
2.1.0
2.1.0-RC.1
2.1.0-RC.2
2.2.0
2.2.0-RC.1
2.2.0-RC.2
2.2.1
2026.*
2026.1.0-beta.1
2026.2.0
2026.2.1
3.*
3.0.0
3.0.0-beta.1
3.0.0-beta.2
3.0.0-beta.3
3.0.0-beta.4
3.0.0-beta.5
3.0.1
3.0.2
3.0.3
4.*
4.0.0
4.0.0-beta.2
4.0.0-beta.3
4.0.0-beta.4
4.0.1
v0.*
v0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108697.json"