The authentication requirement in CVE-2026-72562 creates a dangerous false sense of mitigation. The admin panel itself is the exploit surface, and compromising it means the attacker already operates within the application's highest trust tier — data exfiltration becomes nearly unrestricted rather than constrained.
Pimcore's DataObject module is the core of the platform — it manages the data structures that power entire business applications. When SQL injection exists in the grid filtering of this module, the authentication wall doesn't meaningfully reduce risk; it shifts the threat model from 'anyone on the internet' to 'anyone with a backend account.' Backend accounts in Pimcore are often provisioned liberally to content managers, developers, and third-party integrators. The attacker doesn't need to breach a perimeter — they need a valid credential, obtained through spear-phishing, credential stuffing, or accidental exposure.
Once inside the admin panel, the DataObject grid represents a normalized, expected workflow for users — meaning this injection lives exactly where defenders are least likely to have anomaly detection. The WHERE clause concatenation pattern in filter operations is a documented vulnerability genus across CMS platforms; this isn't novel, it's a repeating pattern with established exploit methodology that security reviews consistently miss because filter operations mentally register as "read-only, low-stakes." The 2.3 version bump is analytically significant: parameterization failures in filter clauses often indicate copy-paste from legacy ORM patterns where developers assumed filter input was inherently sanitized by the framework.
The CVSS 8.8 rating is technically accurate but organizationally misleading. The DataObject module in most Pimcore deployments IS the application — it powers the frontend, APIs, integrations, and reporting. An attacker pivoting from 'I can run SQL' to 'I can manipulate objects feeding every downstream consumer' has moved from database compromise to full application compromise in a single hop. The admin panel typically has bidirectional trust with the data it governs — the same account that filters the grid can often write objects, trigger exports, and access configurations impossible from an external foothold.
Review your Pimcore role configurations: does the default DataObject grid access extend to users who don't strictly need it? Every additional credential granting this access compounds the exposure window. The vulnerability doesn't need to break a perimeter — it turns a compromised credential into the highest-trust architectural position available.