CVE-2026-48011: Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-10 · updated 2026-07-23
Weakness: CWE-208

Description

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.

Affected products

shopware: from 6.7.0.0, < 6.7.10.1; before 6.6.10.18

References

https://github.com/shopware/shopware/releases/tag/v6.6.10.18
https://github.com/shopware/shopware/releases/tag/v6.7.10.1
https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw
https://github.com/shopware/shopware/security/advisories/GHSA-7w52-7jvm-m9vw

Get alerted when CVE-2026-48011 or the next vulnerability affects your stack