CVE-2026-25878CWE-306

FroshAdminer Adminer UI is accessible without admin session

Medium · published February 9, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00551 · 45.3th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-02-09T20:53Z
EPSS history
Timeline
  • 09 FEB 20:53Z
    FroshAdminer Adminer UI is accessible without admin session
    cvelistv5