{"items":[{"id":"NVI-00007582","kind":"vulnerability","title":"Shopware exposes sensitive user information via CSV export mapping","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-27c9-vp3w-6ww8"],"plain_summary":"OSV carries this publisher advisory for shopware/platform, shopware/platform, shopware/core, shopware/core. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 6.7.3.1 for shopware/platform. Confirm the publisher’s latest guidance.","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.6.10.7 for shopware/platform. Confirm the publisher’s latest guidance.","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.7.3.1 for shopware/core. Confirm the publisher’s latest guidance.","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 6.6.10.7 for shopware/core. Confirm the publisher’s latest guidance.","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e140701a7a4f444b4212bd89a22a9eb6","url":"https://github.com/advisories/GHSA-27c9-vp3w-6ww8","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-27c9-vp3w-6ww8","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:40.012Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"technology":"shopware/platform","known_exclusions":[],"conditions_summary":"### Impact\nMalicious actors can exploit this finding to export sensitive customer information from a Shopware application, including password hashes and password reset tokens. In SaaS deployments, this primarily affects customer accounts. In on-premise deployments, however, it also includes the hashes and recovery tokens of administrator-level accounts, which increases\nthe potential impact. \nThis risk is noteworthy because users may reuse the same or similar passwords across different services. In such cases, exposed hashes could allow attackers to recover credentials that might also be valid outside of Shopware.\n\n#### Description\nSensitive information disclosure occurs when an application inadvertently displays sensitive information to its users. Depending on the context, websites can leak all kinds of information including:\n• Data regarding other users, such as usernames and/or e-mail addresses\n• Sensitive commercial data such as customer names\n• Technical details about the website and/or the underlying infrastructure\nDisclosing technical details, such as detailed version information, allows malicious actors to look for targeted vulnerabilities and/or misconfigurations in the app","public_affected_ranges":["ECOSYSTEM: introduced 6.7.0.0; fixed 6.7.3.1"]},{"certainty":"source_listed","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"technology":"shopware/platform","known_exclusions":[],"conditions_summary":"### Impact\nMalicious actors can exploit this finding to export sensitive customer information from a Shopware application, including password hashes and password reset tokens. In SaaS deployments, this primarily affects customer accounts. In on-premise deployments, however, it also includes the hashes and recovery tokens of administrator-level accounts, which increases\nthe potential impact. \nThis risk is noteworthy because users may reuse the same or similar passwords across different services. In such cases, exposed hashes could allow attackers to recover credentials that might also be valid outside of Shopware.\n\n#### Description\nSensitive information disclosure occurs when an application inadvertently displays sensitive information to its users. Depending on the context, websites can leak all kinds of information including:\n• Data regarding other users, such as usernames and/or e-mail addresses\n• Sensitive commercial data such as customer names\n• Technical details about the website and/or the underlying infrastructure\nDisclosing technical details, such as detailed version information, allows malicious actors to look for targeted vulnerabilities and/or misconfigurations in the app","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 6.6.10.7"]},{"certainty":"source_listed","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"technology":"shopware/core","known_exclusions":[],"conditions_summary":"### Impact\nMalicious actors can exploit this finding to export sensitive customer information from a Shopware application, including password hashes and password reset tokens. In SaaS deployments, this primarily affects customer accounts. In on-premise deployments, however, it also includes the hashes and recovery tokens of administrator-level accounts, which increases\nthe potential impact. \nThis risk is noteworthy because users may reuse the same or similar passwords across different services. In such cases, exposed hashes could allow attackers to recover credentials that might also be valid outside of Shopware.\n\n#### Description\nSensitive information disclosure occurs when an application inadvertently displays sensitive information to its users. Depending on the context, websites can leak all kinds of information including:\n• Data regarding other users, such as usernames and/or e-mail addresses\n• Sensitive commercial data such as customer names\n• Technical details about the website and/or the underlying infrastructure\nDisclosing technical details, such as detailed version information, allows malicious actors to look for targeted vulnerabilities and/or misconfigurations in the app","public_affected_ranges":["ECOSYSTEM: introduced 6.7.0.0; fixed 6.7.3.1"]},{"certainty":"source_listed","source_ids":["sr-e140701a7a4f444b4212bd89a22a9eb6"],"technology":"shopware/core","known_exclusions":[],"conditions_summary":"### Impact\nMalicious actors can exploit this finding to export sensitive customer information from a Shopware application, including password hashes and password reset tokens. In SaaS deployments, this primarily affects customer accounts. In on-premise deployments, however, it also includes the hashes and recovery tokens of administrator-level accounts, which increases\nthe potential impact. \nThis risk is noteworthy because users may reuse the same or similar passwords across different services. In such cases, exposed hashes could allow attackers to recover credentials that might also be valid outside of Shopware.\n\n#### Description\nSensitive information disclosure occurs when an application inadvertently displays sensitive information to its users. Depending on the context, websites can leak all kinds of information including:\n• Data regarding other users, such as usernames and/or e-mail addresses\n• Sensitive commercial data such as customer names\n• Technical details about the website and/or the underlying infrastructure\nDisclosing technical details, such as detailed version information, allows malicious actors to look for targeted vulnerabilities and/or misconfigurations in the app","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 6.6.10.7"]}],"null_published_at":"2026-10-31T22:13:18.626Z","source_updated_at":"2026-09-10T03:50:29.009Z","source_disclosed_at":"2025-10-21T18:03:16.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:41:40.012Z"}],"next_cursor":null,"snapshot_revision":"42594"}