Shopware vulnerabilities
67 CVEs and advisories name Shopware as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-104937CVE-2026-104937
- CVE-2026-48012Shopware SSO referer trust leading to an arbitrary redirect target
- CVE-2026-48013Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
- CVE-2026-48009Shopware: Admin Account Takeover via User Recovery Hash Exposure
- CVE-2026-48014Shopware: Admin API ACL Bypass in Order State Transition Endpoints
- CVE-2026-48010Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
- CVE-2026-48016Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
- CVE-2026-48015Shopware: Stored XSS via SVG file upload — no SVG sanitization
- CVE-2026-48008Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
- CVE-2026-48011Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
- CVE-2026-32142shopware/commercial: `/api/_info/config` route exposes information about licenses
- CVE-2026-31889Shopware has a potential take over of app credentials
- CVE-2026-31888Shopware has user enumeration via distinct error codes on Store API login endpoint
- CVE-2026-31887Shopware unauthenticated data extraction possible through store-api.order endpoint
- CVE-2026-23498Shopware Improper Control of Generation of Code in Twig rendered views
- CVE-2025-67648Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page
- CVE-2025-7954Race Condition in Shopware Voucher Submission
- CVE-2025-32378Shopware's default newsletter opt-in settings allow for mass sign-up abuse
- CVE-2025-30150Shopware 6 allows attackers to check for registered accounts through the store-api
- CVE-2025-30151Shopware allows Denial Of Service via password length
- CVE-2024-42357Shopware vulnerable to blind SQL-injection in DAL aggregations
- CVE-2024-42356Shopware vulnerable to Server Side Template Injection in Twig using Context functions
- CVE-2024-42355Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
- CVE-2024-42354Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
- CVE-2024-31447Shopware has Improper Session Handling in store-api
- CVE-2024-27917Shopware's session is persistent in Cache for 404 pages
- CVE-2024-22406Blind SQL-injection in DAL aggregations in Shopware
- CVE-2024-22407Broken Access Control order API in Shopware
- CVE-2024-22408Server-Side Request Forgery (SSRF) in Shopware Flow Builder
- CVE-2023-34099Improper mail validation in Shopware