low3.7
CVE-2026-48011
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Impact
Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | shopware/platform | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| composer | shopware/core | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-7w52-7jvm-m9vw
- https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-48011