Log in Start free

Vulnerability · Published Mar 11, 2026 · Assigned by GitHub_M

CVE-2026-31888Shopware has user enumeration via distinct error codes on Store API login endpoint

Medium 5.3

In plain English

A medium-severity security flaw in core from shopware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 83.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_NOT_FOUND). The "not found" response also echoes the probed email address. This allows an unauthenticated attacker to enumerate valid customer accounts. The storefront login controller correctly unifies both error paths, but the Store API does not — indicating an inconsistent defense. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistshopware/core6.7.8.1GHSA-gqc5-xv7m-gcjq
Packagistshopware/core6.6.10.15GHSA-gqc5-xv7m-gcjq
Packagistshopware/platform6.7.8.1GHSA-gqc5-xv7m-gcjq
Packagistshopware/platform6.6.10.14GHSA-gqc5-xv7m-gcjq

Affected products (as reported)

VendorProductVersions
shopware core >= 6.7.0.0, < 6.7.8.1< 6.6.10.15
shopware platform >= 6.7.0.0, < 6.7.8.1< 6.6.10.14

Weakness: CWE-204 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References