Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts

Vulnerability

The Customer Management Framework (CMF) for Pimcore contains an improper access control vulnerability in the /admin/customermanagementframework/gdpr-data/search-data-objects endpoint. The searchDataObjectsAction method in GDPRDataController.php does not enforce permission checks, allowing any authenticated user to query the endpoint and retrieve customer data [1], [3]. This occurs because the controller lacks a checkPermission call that would normally restrict access to users with the gdpr_data_extractor permission [4].

Exploitation

An attacker with a valid, unprivileged account (e.g., a user assigned a role with no permissions) can directly access the endpoint by making a GET request with optional query parameters (id, firstname, lastname, email, page, limit) [3]. The vulnerability requires prior authentication but no special privileges beyond a basic user account. The attacker can enumerate customer records by modifying the query parameters, leading to systematic extraction of PII.

Impact

An unauthorized user can access personally identifiable information (PII) of customers managed by the CMF, including but not limited to names, email addresses, and other sensitive data [1], [3]. This exposure violates data protection requirements and can lead to privacy breaches, regulatory fines, and reputational damage.

Mitigation

The vulnerability has been patched in version 4.0.6 of the pimcore/customer-data-framework package [1]. The fix adds a checkPermission('gdpr_data_extractor') call in the onKernelControllerEvent method of the controller, ensuring that only users with the appropriate permission can access the endpoint [4]. Administrators should immediately upgrade to version 4.0.6 or later. Note that this OSS repository has been archived and the community-supported version is EOL; users are advised to migrate to the Pimcore Enterprise Edition for continued support [2].