CVE-2026-103905
HighCVSS 7.5Summary
A vulnerability in JTL-Shop's authentication middleware processes the plugin safe mode toggle on the admin logout route before checking authentication. An unauthenticated attacker can toggle the safe mode, deactivating all plugins and causing a shop-wide denial of service.
Risk Assessment
The attack can disable payment and shipping integrations, leading to shop downtime and financial losses.
Recommendation
Immediately update JTL-Shop and apply vendor patches, and restrict access to the admin panel.
Other vulnerabilities in JTL-Shop
See all- CVE-2026-103904Critical
The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend, allowing script code injection that executes in an administrator's browser session.
- CVE-2026-54390Critical
JTL Shop versions 5.2.0 through 5.7.1 contain a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax due to unsanitized user-supplied input passed to the Smarty template engine.
Original NVD description (English source)
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS