Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Shopware |
|
No data.
No data.
References
History
Thu, 12 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Shopware
Shopware platform Shopware shopware |
|
| Vendors & Products |
Shopware
Shopware platform Shopware shopware |
Wed, 11 Mar 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15. | |
| Title | Shopware unauthenticated data extraction possible through store-api.order endpoint | |
| Weaknesses | CWE-863 | |
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2026-03-11T18:49:46.294Z
Updated: 2026-03-11T18:49:46.294Z
Reserved: 2026-03-09T21:59:02.687Z
Link: CVE-2026-31887
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-11T19:16:04.950
Modified: 2026-03-11T19:16:04.950
Link: CVE-2026-31887
Redhat
No data.