Pimcore’s CustomReports module contains an authorization inconsistency between the report listing endpoint and the report detail endpoint. This flaw allows a backend user who has only the generic reports permission to request a report that has not been shared, such as "poc-secret-report", and receive its full metadata, including name, grouping information, display and icon data, data source configuration, column configuration, and sharing settings even when the report’s shareGlobally flag is false. The vulnerability results in the confidential disclosure of report configuration data but does not enable code execution, data modification, or other destructive actions.

The issue affects installations of Pimcore that include the CustomReportsBundle component. Any site running a Pimcore version prior to 11.5.17 on the LTS line or prior to 12.3.6 on the current release line is vulnerable. Versions 11.5.17 (LTS) and 12.3.6 and later contain the fix and are not affected.

The CVSS score of 7.1 classifies this as high severity. The EPSS score of less than 1% indicates that, at present, the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated backend user with the reports permission, which could be an insider or an attacker who has compromised such an account. The attacker can trigger the bypass by sending a request to the report detail endpoint with a valid report name, thereby retrieving metadata that should remain private. This is an authenticated access flaw; it does not require additional system compromise or remote code execution.