Summaryinfo

A vulnerability classified as problematic has been found in Shopware up to 6.10.14/7.8.0. This issue affects some unknown processing of the file /api/_info/config. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-32142. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Shopware up to 6.10.14/7.8.0. It has been rated as problematic. This issue affects some unknown processing of the file /api/_info/config. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Shopware is an open commerce platform. /api/_info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-32142 since 03/10/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 6.10.15 or 7.8.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• Shopware

Version

• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4
• 6.10.5
• 6.10.6
• 6.10.7
• 6.10.8
• 6.10.9
• 6.10.10
• 6.10.11
• 6.10.12
• 6.10.13
• 6.10.14
• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8.0

License

• commercial

Website

• Product: https://github.com/shopware/shopware/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion