CVE Catalog
CVE-2026-48011
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk0.22%
13th percentile - higher than 13% of all known CVEs
Summary
Shopware before versions 6.6.10.18 and 6.7.10.1 allows an attacker to enumerate administrator usernames via a timing attack.
Risk Assessment
Risk of administrator username disclosure, facilitating brute-force or phishing attacks.
Recommendation
Update Shopware to version 6.6.10.18 or 6.7.10.1; consider introducing login delays.
Original NVD description (English source)
Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.