CVE-2026-31887CWE-863

Shopware unauthenticated data extraction possible through store-api.order endpoint

High · published March 11, 2026

CVSS v4.0
8.9
EPSS
0%
Percentile
34.0
In the wild
Unconfirmed
What it is

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00409 · 34.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-11T18:49Z
EPSS history
Timeline
  • 11 MAR 18:49Z
    Shopware unauthenticated data extraction possible through store-api.order endpoint
    cvelistv5