Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Shopware's shopware/platform (before 6.6.10.14 and from 6.7.0.0 up to 6.7.8.1) and shopware/core (before 6.6.10.15 and from 6.7.0.0 up to 6.7.8.1) return different error codes from the Store API login endpoint depending on whether an email address is registered, which lets an unauthenticated attacker enumerate valid customer accounts. The "not found" response also echoes the probed email address. The source suggests returning one generic error for both cases, but the fixed versions are 6.6.10.14 and 6.7.8.1 for shopware/platform and 6.6.10.15 and 6.7.8.1 for shopware/core, so upgrade to those.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0025, the 16th percentile, on 7 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:02 UTC First seen by agentprime
- 31 Oct 2026, 14:02 UTC Confirmed by OSV