CVE-2026-32100: swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-12 · updated 2026-06-17
Weakness: CWE-200

Description

Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7.

Affected products

swag platform-security: from 4.0.0, < 4.0.7; from 3.0.0 < 3.0.12; before 2.0.16

References

https://github.com/shopware/shopware/security/advisories/GHSA-64rg-pgjv-4v33

Get alerted when CVE-2026-32100 or the next vulnerability affects your stack