Weak Password Recovery Mechanism for Forgotten Password in Pimcore Studio Backend bundle - CVE-2026-55207

Detailed vulnerability description

The vulnerability allows a remote attacker to hijack an administrator account and bypass two-factor authentication.

The vulnerability exists due to a weak password recovery mechanism in the reset password endpoint and token-based login flow when processing a password reset request with an attacker-controlled reset URL and a victim later follows the emailed link. A remote attacker can submit a password reset request that causes a valid recovery token to be sent to an attacker-controlled server to hijack an administrator account and bypass two-factor authentication.

User interaction is required because the victim must click a legitimate password reset link delivered by the application.

How to mitigate CVE-2026-55207

Sources

• https://github.com/pimcore/pimcore/security/advisories/GHSA-h854-c3m3-mh5v