Shopware Platform vulnerabilities

CVE-2021-32716 [MEDIUM] CWE-200 CVE-2021-32716: Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has expose Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For o

CVE-2024-31447 [MEDIUM] CWE-613 Shopware Improper Session Handling in store-api account logout Shopware Improper Session Handling in store-api account logout ### Impact When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. ### Patches The problem has been fix

CVE-2026-48013 [MEDIUM] CWE-918 CVE-2026-48013: Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/exte Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel `uploadFromURL` flow validates target IPs against private/reserved ranges via `FileUrlValidator`, the `l

CVE-2025-32378 [LOW] CWE-1188 Shopware default newsletter opt-in settings allow for mass sign-up abuse Shopware default newsletter opt-in settings allow for mass sign-up abuse ### Impact Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are: Newsletter: Double Opt-in - active Newsletter: Double opt-in for registered customers - disabled Log-in & sign-up: Double opt-in on sign-up - disabled With these sett

CVE-2026-48016 [MEDIUM] CWE-639 CVE-2026-48016: Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /stor Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentica

CVE-2026-48012 [MEDIUM] CWE-601 CVE-2026-48012: Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Sh Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the val

CVE-2021-37710 [MEDIUM] CWE-79 CVE-2021-37710: Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Script Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a Cross-Site Scripting vulnerability via SVG media files. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

CVE-2021-32709 [MEDIUM] CWE-306 CVE-2021-32709: Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in Shopware is an open source eCommerce platform. Creation of order credits was not validated by ACL in admin orders. Users are recommend to update to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measur

CVE-2020-13971 [MEDIUM] CWE-79 Shopware vulnerable to Cross-site Scripting Shopware vulnerable to Cross-site Scripting In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.

CVE-2026-48011 [LOW] CWE-208 Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames ### Summary There is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack. ### Details The faulty code exists in [`src/Core/Framework/Api/OAuth/UserRepository.php`](https://github.com/shopware/shopware/blob/trunk/src

CVE-2022-24744 [LOW] CWE-613 CVE-2022-24744: Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript fram Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions user sessions are not logged out if the password is reset via password recovery. This issue has been resolved in version 6.4.8.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via