CVE-2026-48011
Fixed upstream EPSS <1%CVSS 3.7
Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.
Products: shopware
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | shopware/core | 6.7.10.1 |
| Packagist | shopware/core | 6.6.10.18 |
| Packagist | shopware/platform | 6.7.10.1 |
| Packagist | shopware/platform | 6.6.10.18 |