UpHeron
All vulnerabilities

Servers and applications

CVE-2025-30150

Check for registered accounts through the store-api

Severity
Medium 5.5
Published
8 Apr 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5.8.18, 6.6.10.3
Also known as
GHSA-hh7j-6x3q-f52h
Sources
NVD, Project advisories (GitHub)

Description

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version before 6.5.8.18
  • From 6.6.0.0 before 6.6.10.3
  • Version 6.7.0.0-rc1
ShopwareServers and applications · github:shopware/shopware
  • Every version before 6.5.8.18
  • Version 6.7.0.0-rc1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-30150
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-30150
  • GitHub Advisory Database https://github.com/advisories/GHSA-hh7j-6x3q-f52h
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-hh7j-6x3q-f52h