CVE-2021-23405: Pimcore

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.

Affected products

• Pimcore Pimcore: before 10.0.7 (fixed in 10.0.7)

Published 2021-07-09. Last modified 2026-06-17.