CVE-2025-32378: Shopware Core and Platform Mass Newsletter Sign-Up Vulnerability
Summary
CVE-2025-32378: Shopware default newsletter opt-in settings allow for mass sign-up abuse. Affects shopware/core across 3 version ranges.
< 6.5.8.17
>= 6.6.0.0-rc1, < 6.6.10.3
>= 6.7.0.0-rc1, < 6.7.0.0-rc2
Fixed in 6.5.8.17, 6.6.10.3 or 6.7.0.0-rc2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopware is an open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and marketing tools. The platform is widely used due to its flexibility and scalability, making it a popular choice for both small and large businesses. However, a vulnerability has been identified in the default newsletter opt-in settings that could allow unauthorized mass sign-ups.
Vulnerability Detail
The vulnerability arises from the default settings for the double-opt-in process for newsletters, which are configured to allow mass unsolicited sign-ups without requiring email confirmation. Specifically, while the double opt-in is active for general newsletter subscriptions, it is disabled for registered customers, and the double opt-in for log-in and sign-up is also disabled. This configuration allows anyone to create an account using any email address and subscribe to the newsletter without confirming their intent, leading to potential spam and abuse.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.5.8.176.5.8.17composer require shopware/core:6.5.8.17 -
>= 6.6.0.0-rc1, < 6.6.10.36.6.10.3composer require shopware/core:6.6.10.3 -
>= 6.7.0.0-rc1, < 6.7.0.0-rc26.7.0.0-rc2composer require shopware/core:6.7.0.0-rc2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For users on older versions of Shopware 6.4, a plugin is available that implements the necessary security measures. It is advisable to install this plugin until an upgrade to the latest version can be performed.
Conclusion
The identified vulnerability in Shopware's newsletter opt-in settings poses a risk of mass unsolicited sign-ups. Users are encouraged to update to the latest patched versions to secure their applications. For those unable to update immediately, a plugin is available as a workaround. Regular monitoring for vulnerabilities is essential, and tools like Vulert can assist in this process.
See every vulnerability recorded for shopware/core →
FAQ
The vulnerability allows for mass unsolicited newsletter sign-ups without email confirmation, potentially leading to spam.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is the potential for abuse through spam sign-ups, which can affect the reputation of the business and lead to increased server load.
Yes, for older versions of Shopware 6.4, a plugin is available that provides the necessary security measures.
If immediate updating is not possible, consider implementing the available plugin as a temporary measure to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for shopware/core.
