SB2026052006 - Multiple vulnerabilities in Shopware

Description

This security bulletin contains information about 3 vulnerabilities.

1) Improper access control (CVE-ID: CVE-2026-31887)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in the store-api.order endpoint when processing deepLinkCode-supported order filter requests. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation can expose foreign customer order data and enable mass enumeration of recent orders.

2) Observable Response Discrepancy (CVE-ID: CVE-2026-31888)

CWE-ID: CWE-204 - Observable Response Discrepancy

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to enumerate valid customer accounts.

The vulnerability exists due to observable response discrepancy in the Store API login endpoint when handling login requests. A remote attacker can submit crafted login attempts with probed email addresses to enumerate valid customer accounts.

The unknown-email response reflects the submitted email address in the error detail and metadata.

3) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-31889)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to obtain API credentials and tamper with app-shop communication.

The vulnerability exists due to authentication bypass by spoofing in the legacy app registration and re-registration flow when processing app re-registration requests that update the shop-url without proving control of the previously registered shop or domain. A remote attacker can re-register an existing app installation with an attacker-controlled domain to obtain API credentials and tamper with app-shop communication.

Exploitation is limited to apps that use a registrationUrl in their app manifest and rely on the legacy HMAC-based registration flow.

Remediation

Install update from vendor's website.

References

• https://github.com/shopware/shopware/security/advisories/GHSA-7vvp-j573-5584
• https://github.com/shopware/shopware/security/advisories/GHSA-gqc5-xv7m-gcjq
• https://github.com/shopware/shopware/security/advisories/GHSA-c4p7-rwrg-pf6p