The WordExport export flow in Pimcore contains an authorization flaw: the controller verifies only the word_export feature permission and then uses attacker‑specified type and ID values without checking whether the user has view access to the targeted page, snippet, email, or object. As a result, any authenticated backend user with minimal privileges can export the content of assets they would otherwise be prohibited from reading, leaking potentially sensitive information.

Pimcore Data & Experience Management Platform, versions earlier than 11.5.17 (LTS) and 12.3.7. These releases expose the WordExport bundle’s TranslationController to the described bypass.

The flaw has a CVSS score of 6.4, indicating a moderate severity level. The EPSS score is below 1 %, suggesting that real‑world exploitation is unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a backend authenticated user acting through the web interface. In practice, an attacker with low‑privileged credentials could directly request the export endpoint and retrieve content otherwise restricted.