CVE-2026-31887: Shopware unauthenticated data extraction possible through store-api.order endpoint

Description

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 15% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

CO

core · shopware

>= 6.7.0.0, < 6.7.8.1; < 6.6.10.15 · source: vendor

PL

platform · shopware

>= 6.7.0.0, < 6.7.8.1; < 6.6.10.15 · source: vendor

SH

Shopware · Shopware

before 6.6.10.15; 6.7.0.0 before 6.7.8.1 · source: NVD