Pimcore Studio allows an authenticated editor to create class definitions through the POST /pimcore-studio/api/class/definition/configuration-view/detail/create endpoint. The endpoint mistakenly verifies the generic objects permission instead of the required classes permission, a weakness classified as CWE-285 Incorrect Authorization. Because class creation results in new database tables and PHP class files, an attacker can gain persistent write access to the application code and schema. In addition, the API bypasses UID format validation, letting malformed identifiers propagate to the model layer and trigger internal exception leakage, further exposing application internals.

Systems running Pimcore Studio versions older than 2025.4.6 or 2026.1.6 are affected. The vulnerability resides strictly within the pimcore system and targets editor‑level users who possess objects permission but lack classes permission. The identified vulnerability impacts the class‑definition creation endpoint exposed via the Studio API.

The CVSS score of 7.1 denotes high severity, while the EPSS score of <1% indicates a very low exploitation probability and its absence from the CISA KEV catalog suggests low current threat. Likely attack vectors involve authenticated users with editor‑level access submitting crafted POST requests to the vulnerable endpoint. By exploiting this flaw, an attacker can elevate privileges, create arbitrary database structures and PHP classes, and potentially exfiltrate or manipulate sensitive data.