Vulnerability-Lookup

CVE-2026-48011 (GCVE-0-2026-48011)

Vulnerability from cvelistv5 – Published: 2026-06-10 20:07 – Updated: 2026-06-11 14:26

Title

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Summary

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-208 - Observable Timing Discrepancy

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/shopware/shopware/security/adv…	x_refsource_CONFIRM
https://github.com/shopware/shopware/releases/tag…	x_refsource_MISC
https://github.com/shopware/shopware/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopware	shopware	Affected: >= 6.7.0.0, < 6.7.10.1 Affected: < 6.6.10.18

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48011",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-11T14:26:27.848867Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T14:26:36.286Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopware",
          "vendor": "shopware",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.7.0.0, \u003c 6.7.10.1"
            },
            {
              "status": "affected",
              "version": "\u003c 6.6.10.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-208",
              "description": "CWE-208: Observable Timing Discrepancy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-10T20:07:02.345Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"
        },
        {
          "name": "https://github.com/shopware/shopware/releases/tag/v6.6.10.18",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopware/shopware/releases/tag/v6.6.10.18"
        },
        {
          "name": "https://github.com/shopware/shopware/releases/tag/v6.7.10.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"
        }
      ],
      "source": {
        "advisory": "GHSA-7w52-7jvm-m9vw",
        "discovery": "UNKNOWN"
      },
      "title": "Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48011",
    "datePublished": "2026-06-10T20:07:02.345Z",
    "dateReserved": "2026-05-20T17:44:09.586Z",
    "dateUpdated": "2026-06-11T14:26:36.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48011",
      "date": "2026-06-12",
      "epss": "0.00027",
      "percentile": "0.08252"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-48011\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-10T22:17:00.850\",\"lastModified\":\"2026-06-11T16:16:23.983\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-208\"}]}],\"references\":[{\"url\":\"https://github.com/shopware/shopware/releases/tag/v6.6.10.18\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/shopware/shopware/releases/tag/v6.7.10.1\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-48011\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-11T14:26:27.848867Z\"}}}], \"references\": [{\"url\": \"https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T14:26:19.828Z\"}}], \"cna\": {\"title\": \"Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames\", \"source\": {\"advisory\": \"GHSA-7w52-7jvm-m9vw\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"shopware\", \"product\": \"shopware\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 6.7.0.0, \u003c 6.7.10.1\"}, {\"status\": \"affected\", \"version\": \"\u003c 6.6.10.18\"}]}], \"references\": [{\"url\": \"https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw\", \"name\": \"https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/shopware/shopware/releases/tag/v6.6.10.18\", \"name\": \"https://github.com/shopware/shopware/releases/tag/v6.6.10.18\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/shopware/shopware/releases/tag/v6.7.10.1\", \"name\": \"https://github.com/shopware/shopware/releases/tag/v6.7.10.1\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-208\", \"description\": \"CWE-208: Observable Timing Discrepancy\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-10T20:07:02.345Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-48011\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T14:26:36.286Z\", \"dateReserved\": \"2026-05-20T17:44:09.586Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-10T20:07:02.345Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48011

Vulnerability from fkie_nvd - Published: 2026-06-10 22:17 - Updated: 2026-06-11 16:16

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/shopware/shopware/releases/tag/v6.6.10.18
	security-advisories@github.com	https://github.com/shopware/shopware/releases/tag/v6.7.10.1
	security-advisories@github.com	https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue."
    }
  ],
  "id": "CVE-2026-48011",
  "lastModified": "2026-06-11T16:16:23.983",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-10T22:17:00.850",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopware/shopware/releases/tag/v6.6.10.18"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-208"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-7W52-7JVM-M9VW

Vulnerability from github – Published: 2026-06-04 19:31 – Updated: 2026-06-11 14:06

Summary

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Details

Summary

There is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack.

Details

The faulty code exists in src/Core/Framework/Api/OAuth/UserRepository.php:

public function getUserEntityByUserCredentials(
        string $username,
        #[\SensitiveParameter]
        string $password,
        string $grantType,
        ClientEntityInterface $clientEntity
    ): ?UserEntityInterface {
        if ($this->loginConfigService->getConfig()?->useDefault === false) {
            // never allow login via password if the default login is disabled (e.g. using SSO only)
            return null;
        }

        $builder = $this->connection->createQueryBuilder();
        $user = $builder->select('user.id', 'user.password')
            ->from('user')
            ->where('username = :username')
            ->setParameter('username', $username)
            ->fetchAssociative();

        // PATH 1: EARLY RETURN WHEN USERNAME IS NOT FOUND
        if (!$user) {
            return null;
        }

        // PATH 2: VERIFY PASSWORD IF USER IS FOUND
        if (!password_verify($password, (string) $user['password'])) {
            return null;
        }

        return new User(Uuid::fromBytesToHex($user['id']));
    }

Subroutine getUserEntityByUserCredentials() is called when an auth request is send to api/oauth/token. If the given username is not found an early return is done (PATH 1). Only if the user is found we verify the password using password_verify.

PHP method password_verify by default uses hashing algorithm Argon2id which by design is intentionally 'slow' by introducing a timing cost to an attempt to bruteforce hashes more costly.

Since password_verify has a notable executable time, PATH 2 where an user is found and verified will be slower on average then PATH 1 where we do an early return for non-existing users.

Proposed fix

Before doing the early return, password_verify a dummy hash.

Impact

More targeted dictionary/bruteforce attacks.
Spear phishing / eases social engineering.
Credential stuffing from other data leaks.

Authors

Niel Duysters (@NielDuysters) and Thomas Brankaer (@tbrankaer)

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0.0"
            },
            {
              "fixed": "6.7.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.10.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.7.0.0"
            },
            {
              "fixed": "6.7.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopware/core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.10.18"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48011"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-208"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T19:31:17Z",
    "nvd_published_at": "2026-06-10T22:17:00Z",
    "severity": "LOW"
  },
  "details": "### Summary\nThere is a Proof of Concept which is able to enumerate the usernames of administrator users. This was possible by performing a timing attack.\n\n### Details\nThe faulty code exists in [`src/Core/Framework/Api/OAuth/UserRepository.php`](https://github.com/shopware/shopware/blob/trunk/src/Core/Framework/Api/OAuth/UserRepository.php):\n```\npublic function getUserEntityByUserCredentials(\n        string $username,\n        #[\\SensitiveParameter]\n        string $password,\n        string $grantType,\n        ClientEntityInterface $clientEntity\n    ): ?UserEntityInterface {\n        if ($this-\u003eloginConfigService-\u003egetConfig()?-\u003euseDefault === false) {\n            // never allow login via password if the default login is disabled (e.g. using SSO only)\n            return null;\n        }\n\n        $builder = $this-\u003econnection-\u003ecreateQueryBuilder();\n        $user = $builder-\u003eselect(\u0027user.id\u0027, \u0027user.password\u0027)\n            -\u003efrom(\u0027user\u0027)\n            -\u003ewhere(\u0027username = :username\u0027)\n            -\u003esetParameter(\u0027username\u0027, $username)\n            -\u003efetchAssociative();\n\n        // PATH 1: EARLY RETURN WHEN USERNAME IS NOT FOUND\n        if (!$user) {\n            return null;\n        }\n\n        // PATH 2: VERIFY PASSWORD IF USER IS FOUND\n        if (!password_verify($password, (string) $user[\u0027password\u0027])) {\n            return null;\n        }\n\n        return new User(Uuid::fromBytesToHex($user[\u0027id\u0027]));\n    }\n```\n\nSubroutine `getUserEntityByUserCredentials()` is called when an auth request is send to `api/oauth/token`. If the given username is not found an early return is done (PATH 1). Only if the user is found we verify the password using `password_verify`.\n\nPHP method `password_verify` by default uses hashing algorithm Argon2id which by design is intentionally \u0027slow\u0027 by introducing a timing cost to an attempt to bruteforce hashes more costly.\n\nSince `password_verify` has a notable executable time, PATH 2 where an user is found and verified will be slower on average then PATH 1 where we do an early return for non-existing users.\n\n### Proposed fix\nBefore doing the early return, `password_verify` a dummy hash.\n\n### Impact\n1. More targeted dictionary/bruteforce attacks.\n2. Spear phishing / eases social engineering.\n3. Credential stuffing from other data leaks.\n\n### Authors\nNiel Duysters (@NielDuysters) and Thomas Brankaer (@tbrankaer)",
  "id": "GHSA-7w52-7jvm-m9vw",
  "modified": "2026-06-11T14:06:35Z",
  "published": "2026-06-04T19:31:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48011"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopware/shopware"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shopware/shopware/releases/tag/v6.6.10.18"
    },
    {
      "type": "WEB",
      "url": "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-48011 (GCVE-0-2026-48011)

FKIE_CVE-2026-48011

GHSA-7W52-7JVM-M9VW

Summary

Details

Proposed fix

Impact

Authors

Tags

Sightings

Nomenclature