The vulnerability involves a missing function-level authorization check on the API endpoint that lists static routes in Pimcore. Because the endpoint is reachable by authenticated backend users who do not have explicit permissions, attackers can obtain the complete configuration of custom URL patterns, including regexes, controllers, and priorities. These configurations provide insight into internal application routing and can aid in crafting targeted attacks against specific controllers or services. The weakness is classified as CWE‑284, reflecting improper authorization.

Pimcore, the open‑source data and experience management platform, is affected in all releases prior to 12.3.1 for the 12.x series and prior to 11.5.14 for the 11.x series. Any installation running those versions exposes the API endpoint that enumerates static routes. Administrators should verify that their deployments are running at least version 12.3.1 of the 12.x line or 11.5.14 of the 11.x line, as the fix was applied in those releases.

The CVSS base score of 4.3 indicates a moderate risk, while the EPSS score of less than 1% shows a low probability of exploitation in the wild. The vulnerability does not appear in the CISA KEV catalog. Attackers must be authenticated to the backend but do not need elevated privileges; thus the impact is limited to confidentiality compromise of route configuration data. Without a patch, any authenticated user could request the listing endpoint and retrieve potentially sensitive routing details.