CVE-2026-48011 Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Attackers can enumerate administrator usernames via timing attacks, exposing sensitive account information in Shopware e-commerce platforms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48011?
CVE-2026-48011 is a low-severity vulnerability in shopware, published on 10 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.
Weakness: CWE-208
Which versions are affected by CVE-2026-48011?
8 open source packages ship an affected version, including shopware/core and shopware/platform.
| Package | Affected | Fixed in |
|---|---|---|
shopware/core Packagist | All versions | 6.6.10.18 |
shopware/core Packagist | All versions | 6.6.10.18 |
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | All versions | 6.6.10.18 |
2 more packages
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
How do I fix CVE-2026-48011?
Upgrade shopware/core to a fixed version for your release line: 6.6.10.18 or 6.7.10.1.
Is CVE-2026-48011 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-48011 exists.
Sources
Also known as GHSA-7w52-7jvm-m9vw.