CVE-2026-31887
HIGH EPSS 14.6%
Published Mar 11, 20263mo ago · Modified Jun 17, 20261w ago
8.9 CVSS 4.0
Published Mar 11, 2026 3mo ago
Last Modified Jun 17, 2026 1w ago
Description
Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
14.6% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-863 Incorrect Authorization Authorization
Affected Products 2
References 1
- github.com https://github.com/shopware/shopware/security/advisories/GHSA-7vvp-j573-5584
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.