CVE-2025-30150: Shopware Core and Platform Account Enumeration Vulnerability
Summary
CVE-2025-30150: Shopware 6 allows attackers to check for registered accounts through the store-api. Affects shopware/core across 3 version ranges.
< 6.5.8.18
>= 6.6.0.0, < 6.6.10.3
>= 6.7.0.0-rc1, < 6.7.0.0-rc2
Fixed in 6.5.8.18, 6.6.10.3 or 6.7.0.0-rc2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is a popular open-source e-commerce platform that enables businesses to create and manage online stores. It provides a robust set of features, including product management, customer management, and various payment options. However, a vulnerability has been identified in Shopware versions 6.4 and later, which allows attackers to check for the existence of registered accounts through the store API, potentially leading to account enumeration attacks.
Vulnerability Detail
The vulnerability arises from the store API endpoint '/store-api/account/recovery-password', which allows attackers to determine if a specific email address is associated with a registered account. When an email address is not found, the API returns a 404 error with a specific message indicating that no matching customer was found. Conversely, a successful account check returns a different response. This discrepancy can be exploited by attackers to enumerate valid email addresses, increasing the risk of targeted phishing attacks or unauthorized access attempts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.5.8.186.5.8.18composer require shopware/core:6.5.8.18 -
>= 6.6.0.0, < 6.6.10.36.6.10.3composer require shopware/core:6.6.10.3 -
>= 6.7.0.0-rc1, < 6.7.0.0-rc26.7.0.0-rc2composer require shopware/core:6.7.0.0-rc2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users on older versions of Shopware 6.4, a plugin is available that implements corresponding security measures. It is advisable to install this plugin until an upgrade to the latest version can be performed.
Conclusion
The CVE-2025-30150 vulnerability in Shopware poses a significant risk by allowing attackers to enumerate registered accounts through the store API. It is crucial for users to update to the patched versions or implement available workarounds to mitigate this risk effectively.
See every vulnerability recorded for shopware/core →
FAQ
CVE-2025-30150 is a vulnerability in Shopware that allows attackers to check for registered accounts through the store API, leading to potential account enumeration.
Shopware versions 6.4 and later are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider using the available plugin for older versions of Shopware 6.4 that implements security measures against this vulnerability.
The primary risk is account enumeration, which can lead to targeted phishing attacks and unauthorized access attempts on user accounts.
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
