Pimcore is an open‑source data and experience management platform. The vulnerability stems from an improper access control check in the Studio API class‑definition creation endpoint. While the endpoint is expected to verify the classes permission, it instead checks the general objects permission new definition generates new database tables and PHP class files on the server, so an attacker can gain write access to application code and database schema. In addition, the API layer fails to validate the UID format before it reaches the model layer, allowing malformed identifiers to trigger internal exceptions that may expose sensitive internals.

Systems affected are installations of Pimcore Studio running a version older than 2025.4.6 or 2026.1.6, which expose the POST /pimcore-studio/api/class/definition/configuration-view/detail/create endpoint. The vulnerability is limited to the pimcore:pimcore product and impacts users with editor‑level permissions who can when they lack the required classes permission.

The CVSS score of 7.1 indicates high severity. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in KEV. Based that the likely attack vector with editor‑level credentials. By using the endpoint to create arbitrary class definitions, surface implementation details.