shopware/platform Security Advisories for v6.6.4.1 (18)
-
[HIGH] Shopware vulnerable to a potential take over of app credentials
PKSA-qj2q-c8sp-3qyg CVE-2026-31889 GHSA-c4p7-rwrg-pf6p
Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1
Reported by:
GitHub -
[MEDIUM] Shopware has user enumeration via distinct error codes on Store API login endpoint
PKSA-8zg6-v85t-wcz3 CVE-2026-31888 GHSA-gqc5-xv7m-gcjq
Affected version: <6.6.10.14|>=6.7.0.0,<6.7.8.1
Reported by:
GitHub -
[HIGH] Shopware: Unauthenticated data extraction possible through store-api.order endpoint
PKSA-bwqq-zb6b-g5dh CVE-2026-31887 GHSA-7vvp-j573-5584
Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1
Reported by:
GitHub -
[MEDIUM] Shopware Customer Orders can be canceled, even if refunds are disabled
PKSA-g23j-x3sb-wcbc GHSA-r2vg-hvjm-fg38
Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1
Reported by:
GitHub -
[MEDIUM] Shopware exposes sensitive user information via CSV export mapping
PKSA-cb17-wqsx-y85w GHSA-27c9-vp3w-6ww8
Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1
Reported by:
GitHub -
[LOW] Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice
PKSA-ph5g-5w5h-nqtz GHSA-3cpp-fv95-mpr5
Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1
Reported by:
GitHub -
[LOW] Shopware vulnerable to path traversal via Plugin upload
PKSA-wg2b-w14d-z55p GHSA-6wh5-mw9h-5c3w
Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1
Reported by:
GitHub -
[MEDIUM] Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually
PKSA-h7xc-cnc9-hq4s GHSA-m895-2hj3-8cg9
Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1
Reported by:
GitHub -
[MEDIUM] Shopware race condition bypasses voucher restrictions
PKSA-sy2r-ddrd-9s1c CVE-2025-7954 GHSA-27gv-mg7w-mm34
Affected version: <=6.6.10.4
Reported by:
GitHub -
[LOW] Shopware default newsletter opt-in settings allow for mass sign-up abuse
PKSA-7zw7-y79b-kv9s CVE-2025-32378 GHSA-4h9w-7vfp-px8m
Affected version: <6.5.8.17|>=6.7.0.0-rc1,<6.7.0.0-rc2|>=6.6.0.0-rc1,<6.6.10.3
Reported by:
GitHub -
[MEDIUM] Shopware Broken ACL on Document retrieval to access other customers documents
PKSA-9qy7-f7jp-k813 GHSA-68wv-g3fw-pq7q
Affected version: <6.5.8.17|>=6.7.0.0-rc1,<6.7.0.0-rc2|>=6.6.0.0,<6.6.10.3
Reported by:
GitHub -
[HIGH] Shopware Vulnerable to Blind SQL-injection in DAL aggregations
PKSA-fkd6-58gd-wqfz CVE-2025-27892 GHSA-8g35-7rmw-7f59
Affected version: <6.5.8.18|>=6.6.0.0,<=6.6.10.2|=6.7.0.0-rc1
Reported by:
GitHub -
[HIGH] Shopware allows Denial Of Service via password length
PKSA-qf2k-hv7v-9bz9 CVE-2025-30151 GHSA-cgfj-hj93-rmh2
Affected version: <6.5.8.17|>=6.7.0.0-rc1,<6.7.0.0-rc2|>=6.6.0.0,<6.6.10.3
Reported by:
GitHub -
[MEDIUM] Shopware 6 allows attackers to check for registered accounts through the store-api
PKSA-4xth-xj4w-m8t1 CVE-2025-30150 GHSA-hh7j-6x3q-f52h
Affected version: <=6.5.8.17|>=6.6.0.0,<=6.6.10.2|=6.7.0.0-rc1
Reported by:
GitHub -
[MEDIUM] Shopware vulnerable to blind SQL-injection in DAL aggregations
PKSA-4jyx-mm79-zmg7 CVE-2024-42357 GHSA-p6w9-r443-r752
Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12
Reported by:
GitHub -
[HIGH] Shopware vulnerable to Server Side Template Injection in Twig using Context functions
PKSA-69f8-ft32-qt99 CVE-2024-42356 GHSA-35jp-8cgg-p4wj
Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12
Reported by:
GitHub -
[HIGH] Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag
PKSA-44zj-btqf-vtmh CVE-2024-42355 GHSA-27wp-jvhw-v4xp
Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12
Reported by:
GitHub -
[MEDIUM] Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
PKSA-c7v1-2zh3-y11f CVE-2024-42354 GHSA-hhcq-ph6w-494g
Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12
Reported by:
GitHub