CoreShop versions up to 2026.2.2 contain a missing authorization flaw in the ResourceController listAction method. The controller bypasses the isGrantedOr403() check, allowing authenticated Pimcore users who normally lack permissions to list restricted resources. Users are able to retrieve collections of payment providers, carriers, price rules, stores, and tax rules, including identifiers, names, and other sensitive fields. This grants visibility into the system’s configuration and asset inventory without requiring elevated privileges, facilitating further reconnaissance or targeted attacks.

The affected product is CoreShop, specifically all releases through 2026.2.2. This includes any installation that has not been upgraded to a version where the authorization check has been restored. Vendors and customers should verify the CoreShop version they are running and consider applying the latest release if available.

The CVSS base score of 5.3 indicates moderate overall risk. The attack requires an authenticated Pimcore backend session but does not require shell or code execution privileges. Because the resource list is exposed via the web interface, an attacker with a low-privileged account can enumerate restricted assets directly over the network. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. However, the ability to enumerate resources can aid attackers in planning more serious exploits.