Threats affecting pkg:github/shopware/shopware

CVE-2026-32142 is a medium severity vulnerability in Shopware commercial versions prior to 7.8.1 and 6.10.15. It involves an information exposure issue where the /api/_info/config endpoint leaks license-related data to unauthorized actors without requiring authentication or user interaction. The vulnerability has a CVSS score of 5.3, indicating moderate risk primarily to confidentiality. No known exploits are currently reported in the wild. Organizations using affected Shopware versions should upgrade to the fixed releases to prevent potential information disclosure that could aid attackers in reconnaissance or further attacks.

CVE-2026-31889 is a high-severity authentication bypass vulnerability in Shopware core affecting versions prior to 6.6.10.15 and 6.7.8.1. It arises from the legacy app registration flow where HMAC-based authentication does not sufficiently bind a shop installation to its original domain. Attackers who possess the app-side secret can abuse the re-registration process to update the shop URL without proving control over the original domain. This allows targeted hijacking of app communication, redirecting traffic to attacker-controlled domains and potentially stealing API credentials.

CVE-2026-31888 is a medium-severity vulnerability in Shopware core versions prior to 6.7.8.1 and 6.6.10.15. It arises from an observable response discrepancy in the Store API login endpoint, which returns different error codes and messages depending on whether an email address is registered or not. This behavior allows unauthenticated attackers to enumerate valid customer accounts by probing email addresses. The storefront login controller does not exhibit this flaw, indicating inconsistent error handling between components.

Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations” object. The ‘name’ field in this “aggregations” object is vulnerable SQL-injection and can be exploited using time-based SQL-queries. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.