CVE-2025-24980 - CVE House
Back to Database
Status published Medium CVE-2025-24980

Pimcore Admin Classic Bundle allows user enumeration

Vulnerability Description

pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumeration on the target via "Forgot password" function. No generic error message has been implemented. This issue has been addressed in version 1.7.4 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-24980

Credits & Attribution

No credits recorded in the NVD database.

References

More from pimcore

View All →
CVE-2025-30166
Pimcore's Admin Classic Bundle allows HTML Injection
Low 1.8
CVE-2025-27617
Pimcore Vulnerable to SQL Injection in getRelationFilterCondition
Medium 6.3
CVE-2024-49370
Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing
High 8.7
CVE-2024-41109
Pimcore vulnerable to disclosure of system and database information behind /admin firewall
Medium 6.3
CVE-2024-32871
Pimcore Vulnerable to Flooding Server with Thumbnail files
High 7.5

Affected Vendor

Affected Software

admin-ui-classic-bundle
Vulnerable Versions:
< 1.7.4

Timeline

Official Publish: February 7th, 2025
Last Modified: January 16th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-204

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.