[HIGH] Shopware vulnerable to a potential take over of app credentials

PKSA-qj2q-c8sp-3qyg CVE-2026-31889 GHSA-c4p7-rwrg-pf6p

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[MEDIUM] Shopware has user enumeration via distinct error codes on Store API login endpoint

PKSA-8zg6-v85t-wcz3 CVE-2026-31888 GHSA-gqc5-xv7m-gcjq

Affected version: <6.6.10.14|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[HIGH] Shopware: Unauthenticated data extraction possible through store-api.order endpoint

PKSA-bwqq-zb6b-g5dh CVE-2026-31887 GHSA-7vvp-j573-5584

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub