CVE-2026-103905

Deferred Deferred - Pending Action

Authentication Bypass in JTL-Shop Admin Backend

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: ENISA

Description

The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103905

EUVD

EUVD-2026-100979

Affected Vendors & Products

Vendor	Product	Version / Range
JTL-Software	GmbH	JTL-Shop 5.3.0
JTL-Software	GmbH	JTL-Shop 5.7.0
JTL-Software	GmbH	JTL-Shop 5.8.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is in the JTL-Shop administration backend's authentication middleware. It allows an unauthenticated remote attacker to toggle the plugin safe mode on the admin logout route without proper authentication checks. This can deactivate all plugins and their functionality, including payment and shipping integrations, causing a complete denial of service for the shop.

Detection Guidance

Check Access-Logs for suspicious entries containing the parameter 'safemode='. This can help identify attempts to exploit the vulnerability by unauthenticated users.

Impact Analysis

An attacker can exploit this to disable all shop plugins, blocking customer orders by showing only a maintenance page. This disrupts business operations and revenue without compromising customer data or server access. The attack is simple and can be automated against many installations.

Compliance Impact

This vulnerability does not directly compromise customer data, credentials, or the server itself, but it can disrupt business operations by disabling payment and shipping integrations through the plugin safe mode manipulation. This denial of service could impact compliance with regulations requiring continuous availability of critical services, such as payment processing under PCI DSS for GDPR or operational integrity under HIPAA.

Mitigation Strategies

Update to JTL-Shop versions 5.6.5, 5.7.5, or 5.8.2, or apply the provided patch files immediately. If using JTL-Hosting, no action is needed as the patch is already applied.

Hi! I’m here to help you understand CVE-2026-103905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70