What’s Vulnerable › Products

shopware platform vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your shopware platform version is affected

Latest shopware platform vulnerabilities

• CVE-2026-48013 — Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation (CVSS 4.1)
• CVE-2026-48012 — Shopware SSO referer trust leading to an arbitrary redirect target (CVSS 4.3)
• CVE-2026-48016 — Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment (CVSS 4.3)
• CVE-2026-48015 — Shopware: Stored XSS via SVG file upload — no SVG sanitization (CVSS 4.9)
• CVE-2026-48014 — Shopware: Admin API ACL Bypass in Order State Transition Endpoints (CVSS 6.5)
• CVE-2026-48010 — Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts (CVSS 6.5)
• CVE-2026-48009 — Shopware: Admin Account Takeover via User Recovery Hash Exposure (CVSS 6.8)
• CVE-2026-48008 — Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass (CVSS 6.5)