Pimcore's Admin Classic Bundle contained an authorization flaw in the API endpoint that lists predefined properties. An authenticated backend user who does not have explicit permission to manage properties can call the endpoint and retrieve the entire set of property configurations, exposing metadata such as names, keys, types and default values. This flaw is a CWE‑284 Missing Authorization weakness and can lead to unauthorized disclosure of configuration information.

The vulnerability affects Pimcore Admin Classic Bundle versions prior to 2.2.3 and 1.7.16. Any backend installation of Pimcore that uses these bundle versions is potentially impacted, regardless of how many users are present in the system.

The CVSS score of 4.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by authenticating to a backend account that lacks property‑management rights and then invoking the vulnerable listing endpoint. Because the data exposed is configuration metadata, the primary concern is confidentiality leakage of system setup rather than direct control over the system.