CVE-2026-55207: Pimcore

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used with POST /pimcore-studio/api/login/token to authenticate with full admin privileges while bypassing two-factor authentication. This issue is fixed in versions 2025.4.6 and 2026.1.6.

Affected products

• Pimcore Pimcore: from 2026.1.0, before 2026.1.6 (fixed in 2026.1.6); before 2025.4.6 (fixed in 2025.4.6)

Published 2026-07-09. Last modified 2026-07-10.