CVE-2026-48011CWE-208
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Low · published June 10, 2026
What it is
Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.
The record
Technical detail
- CVSS v3.1
- 3.7 · LOW
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00355 · 28.0th percentile
- Weakness
- CWE-208 · Observable Timing Discrepancy
- Published
- 2026-06-10T20:07Z
EPSS history
Timeline