CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted… (CVE-2026-108697)

The vulnerability in CoreShop up to version 2026.2.2 is due to a missing authorization check in the ResourceController's listAction method. This flaw allows low-privileged backend users to bypass permission restrictions and retrieve lists of sensitive resources. Specifically, the isGrantedOr403() check is skipped, enabling authenticated Pimcore users without appropriate permissions to enumerate payment providers, carriers, price rules, stores, and tax rules with associated metadata. This is classified under CWE-862 (Missing Authorization).

The impact is limited to information disclosure of permission-restricted resources to low-privileged authenticated backend users. There is no indication of integrity or availability impact. The disclosed information includes identifiers and names of payment providers, carriers, price rules, stores, and tax rules, which could aid an attacker in further reconnaissance or privilege escalation attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user permissions to trusted personnel only and monitor for unusual access patterns. Avoid granting unnecessary backend access to low-privileged users.