Studio backend bundle: Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation (CVE-2026-55212)

The Studio API class definition creation endpoint in pimcore/studio-backend-bundle is guarded by the 'objects' permission rather than the intended 'classes' permission, enabling privilege escalation for users with editor-level access. Creating class definitions is a structural admin operation that creates database tables and PHP class files, which should be restricted. The API endpoint POST /pimcore-studio/api/class/definition/configuration-view/detail/create can be called by any authenticated user with 'objects' permission to create classes, bypassing admin-only restrictions enforced in the Classic Admin UI. Furthermore, the API layer performs only an empty-string check on the 'uid' parameter without format validation, relying on downstream model validation that returns unformatted internal exceptions on failure, potentially leaking stack traces. The vulnerability affects pimcore/studio-backend-bundle versions >=2026.1.0 <2026.1.6. A patch is available to correct the permission check and improve validation.

Any authenticated Pimcore user with the standard 'objects' permission can escalate privileges by creating new class definitions via the Studio API, bypassing intended admin-only restrictions. This allows unauthorized structural changes to the system, including creation of new database tables and PHP class files, which can compromise system integrity and security. Improper validation of the 'uid' field at the API boundary can also lead to exposure of internal error details, potentially aiding attackers in crafting further attacks.

A patch is available that corrects the permission check on the vulnerable API endpoint to require the 'classes' permission instead of 'objects'. It also adds proper format validation for the 'uid' parameter at the API boundary to prevent malformed inputs and internal error exposure. Users should upgrade pimcore/studio-backend-bundle to version 2026.1.6 or later. Until patched, restrict access to the Studio API to trusted users only and monitor for unauthorized class creation attempts.