Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-25878 FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The… https://www.cve.org/CVERecord?id=CVE-2026-25878
Post summary
CVE-2026-25878 is an authentication‑bypass vulnerability in the Shopware Adminer plugin, disclosed with specific technical details but without a PoC, exploit code, or evidence of active exploitation.
CVE-2026-25878: Open House at the Database: FroshPlatformAdminer Auth Bypass A classic case of 'explicitly insecure configuration' found in the FroshPlatformAdminer plugin for Shopware. Developers explicitly disabled authentication checks on the prima... https://cvereports.com/reports/CVE-2026-25878
Post summary
The post announces a new CVE involving a configuration error that disables authentication checks in the FroshPlatformAdminer plugin, but does not mention PoC, exploit tools, active attacks, or fixes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | friendsofshopware | froshadminer | - | - | - |