CVE-2026-48011CWE-208

Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

Low · published June 10, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2026-06-10T20:07Z
EPSS history
Timeline
  • 10 JUN 20:07Z
    Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
    cvelistv5