shopware platform vulnerabilities

CVEs per yearBy the year they were published

1. 202110
2. 20227
3. 20235
4. 202611

Newest CVEs

• CVE-2026-48012

  Shopware SSO referer trust leading to an arbitrary redirect target

  shopware · shopware

  Medium4.3
• CVE-2026-48013

  Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

  shopware · shopware

  Medium4.1
• CVE-2026-48009

  Shopware: Admin Account Takeover via User Recovery Hash Exposure

  shopware · shopware

  Medium6.8
• CVE-2026-48014

  Shopware: Admin API ACL Bypass in Order State Transition Endpoints

  shopware · shopware

  Medium6.5
• CVE-2026-48010

  Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

  shopware · shopware

  Medium6.5
• CVE-2026-48016

  Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

  shopware · shopware

  Medium4.3
• CVE-2026-48015

  Shopware: Stored XSS via SVG file upload — no SVG sanitization

  shopware · shopware

  Medium4.9
• CVE-2026-48008

  Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

  shopware · shopware

  Medium6.5
• CVE-2026-31889

  Shopware has a potential take over of app credentials

  shopware · core

  High8.9
• CVE-2026-31888

  Shopware has user enumeration via distinct error codes on Store API login endpoint

  shopware · core

  Medium5.3