GHSA-9wwg-r3c7-4vfg
GitHub Security Advisory
Pimcore Admin UI has Two Factor Authentication disabled for non admin security firewalls
✓ GitHub Reviewed
HIGH
Has CVE
Advisory Details
### Impact
`AdminBundle\Security\PimcoreUserTwoFactorCondition` introduced in v11 disable the two factor authentication for all non-admin security firewalls.
An authenticated user can access the system without having to provide the 2 factor credentials.
### Patches
Apply patch https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch
### Workarounds
Upgrade to version 1.2.2 or apply the [patch](https://patch-diff.githubusercontent.com/raw/pimcore/admin-ui-classic-bundle/pull/345.patch) manually.
Affected Packages
Packagist
pimcore/admin-ui-classic-bundle
Affected versions:
0
(fixed in 1.2.2)
Related CVEs
Key Information
7.5
/10
Dataset
Last updated: November 25, 2025 6:29 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.