CVE-2026-45704: Pimcore has a CustomReports Share Bypass

CustomReports uses inconsistent authorization between the report listing endpoint and the report detail endpoint.

• The listing flow filters reports based on report-sharing rules
• The detail flow only checks generic reports or reports_config permissions

As a result, a low-privileged backend user who was not granted access to a report can still read that report directly by name even though it does not appear in the user’s visible report list.

In the local Docker reproduction:

• The report poc-secret-report was not visible to the low-privileged user in the report list
• The same user was still able to retrieve the report configuration directly by name