Admin Account Takeover via ResetLink in Pimcore <=2025.4.5/2026.1.5
CVE-2026-55207 Published on July 9, 2026
Pimcore: Account Takeover via Password Reset URL Injection allows unauthenticated attacker to hijack any admin account with 2FA bypass
Pimcore is an Open Source Data & Experience Management Platform. Prior to 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any Pimcore admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real cryptographic recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used with POST /pimcore-studio/api/login/token to authenticate with full admin privileges while bypassing two-factor authentication. This issue is fixed in versions 2025.4.6 and 2026.1.6.
Vulnerability Analysis
CVE-2026-55207 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-55207. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
Weak Password Recovery Mechanism for Forgotten Password
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Products Associated with CVE-2026-55207
Want to know whenever a new CVE is published for Pimcore? stack.watch will email you.
Affected Versions
pimcore:- Version >= 2026.1.0, < 2026.1.6 is affected.
- Version < 2025.4.6 is affected.