CVE-2026-25878 FroshAdminer Adminer UI is accessible without admin session
Unauthenticated attackers can access the Adminer database interface in Shopware due to missing session validation, allowing potential data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25878?
CVE-2026-25878 is a medium-severity missing authorization vulnerability in FriendsOfShopware FroshPlatformAdminer, published on 9 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.
Weakness: CWE-306
Which versions are affected by CVE-2026-25878?
2 open source packages ship an affected version, including frosh/adminer-platform. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
frosh/adminer-platform Packagist | All versions | 2.2.1 |
frosh/adminer-platform Packagist | All versions | 2.2.1 |
Products include Friendsofshopware Froshadminer.
How do I fix CVE-2026-25878?
Upgrade frosh/adminer-platform to 2.2.1 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25878 being exploited?
There is no known exploitation of CVE-2026-25878 in the wild and no public exploit code.
Sources
Also known as GHSA-f339-246p-wwjp.