Studio backend bundle: Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass (CVE-2026-55207)

The vulnerability (CVE-2026-55207) exists in the Pimcore Studio Backend Bundle's password reset functionality. The reset password endpoint accepts an attacker-controlled resetPasswordUrl parameter without validation, allowing an attacker to inject a URL of their choosing. The server generates a cryptographic recovery token and appends it to this URL, then sends the link to the victim's email. When the victim clicks the link, the token is captured by the attacker. The attacker then uses the token to authenticate via the token login API, which explicitly disables two-factor authentication, enabling full admin account takeover. The token is valid for 24 hours and single-use. The vulnerability was confirmed on Pimcore 12.x (2026.x branch) and affects versions <2025.4.6 and >=2026.1.0 <2026.1.6. The vulnerability is tracked as CWE-640 and has a CVSS 3.1 score of 8.8 (High).

An unauthenticated attacker who knows a valid admin username can fully compromise the admin account by tricking the victim into clicking a password reset link containing a token sent to the attacker. This results in complete administrative control over the Pimcore instance, including CMS content, digital assets, product data, user accounts, system configuration, and server-side code execution. The attack bypasses authentication, two-factor authentication, and rate limiting, making it highly impactful.

A patch is available for this vulnerability. The recommended fix is to remove the resetPasswordUrl parameter entirely and have the server construct the password reset URL internally to prevent injection. Users should apply the official patch or upgrade to a fixed version as soon as possible. No additional mitigation steps are indicated by the vendor advisory.