An authenticated backend user can access the API endpoint that manages "Favourite Output Channel Configurations" without proper server‑side checks, allowing the user to modify or retrieve these configurations. This lack of function‑level authorization permits unauthorized configuration changes, potentially altering print output behavior or compromising data integrity.

Pimcore Web2Print Tools Bundle, versions prior to 5.2.2 and 6.1.1. Users of the Pimcore platform with the Web2Print Tools package deployed in these versions are affected.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS of less than 1% suggests a low exploitation probability at this time. The vulnerability is not listed in CISA’s KEV catalog, so there is no evidence of active exploitation. The likely attack vector involves an authenticated backend user, so the threat is limited to individuals who have legitimate platform access. If such a user accepts the exploit, they can alter printing configuration settings without permission, thereby gaining unauthorized control over print‑related outputs.