Information disclosure in Shopware - CVE-2026-48009
Published: May 20, 2026
Vulnerability identifier: #VU131955
CSH Severity: Low
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48009
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to take over any admin account.
The vulnerability exists due to exposure of sensitive information in the user_recovery entity hash field via the Admin API search endpoint when processing user recovery records through POST /api/search/user-recovery. A remote user can trigger password recovery for a victim account, read the recovery hash, and submit it to the password reset endpoint to take over any admin account.
The issue depends on combining an authenticated read of the recovery hash with unauthenticated password recovery trigger and password reset endpoints.
Affected software
Shopware
How to mitigate CVE-2026-48009
Install security update from vendor's website.
Shopware - addressed in versions 6.6.10.18, 6.7.10.1