CVE-2026-55207: Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

high Affects pimcore/studio-backend-bundle. Feed 2026.10.29.1, updated 2026-10-28; published 2026-08-28.

Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass

Package: pimcore/studio-backend-bundle Composer
Affected versions: <2025.4.6 or >=2026.1.0 and <2026.1.6
Fixed in: 2025.4.6, 2026.1.6
Severity: high CVSS 8.8
Exploitation: not on CISA KEV · EPSS 1% (51.7th percentile)
Published: 2026-08-28
Source: osv.dev

References

NVD record pimcore/studio-backend-bundle advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2026-55208 high Pimcore: SQL Injection via Column Name in DateFilter allows authenticated user to extract same package: pimcore/studio-backend-bundle
CVE-2026-55212 high Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privil same package: pimcore/studio-backend-bundle
CVE-2017-7615 high MantisBT allows arbitrary password reset same weakness: CWE-640
CVE-2017-8295 medium WordPress through 4.7.4 relies on the Host HTTP header for a password-reset e-mail message same weakness: CWE-640
CVE-2020-11027 medium In affected versions of WordPress, a password reset link emailed to a user does not expire same weakness: CWE-640
CVE-2017-5594 high Pagekit Weak Password Recovery Mechanism for Forgotten Password same weakness: CWE-640