Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. This vulnerability is fixed in 6.7.8.1 and 6.6.10.15.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-31887 Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, an insufficient check on the filter types for unauthenticated customers allows access to orders… https://www.cve.org/CVERecord?id=CVE-2026-31887
Post summary
The post announces CVE-2026-31887, describing its impact on Shopware's order access for unauthenticated customers, but it contains no PoC, exploit, active exploitation claim, or patch information.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-31887 - Shopware unauthenticated data extraction possible through store-api.order endpoint Intel Report: https://ift.tt/rDCe5gb
Post summary
The alert reveals CVE‑2026‑31887, a Shopware vulnerability enabling unauthenticated data extraction via the store‑api.order endpoint, with no PoC, exploit, or remediation details provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | shopware | shopware | - | - | - |