QwikSec

Security Database

CVE

CWE

Training

CVE-2026-31887

Published: Mar 11, 2026

Modified: Mar 12, 2026

PUBLISHED

Description

Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.

Vendor	Product	Versions
shopware	core	affected `>= 6.7.0.0, < 6.7.8.1` affected `< 6.6.10.15`
shopware	platform	affected `>= 6.7.0.0, < 6.7.8.1` affected `< 6.6.10.15`

Weaknesses (CWE)

References

https://github.com/shopware/shopware/security/advisories/GHSA-7vvp-j573-5584

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.