Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-32142 is a moderate severity vulnerability in the Shopware commerce platform affecting versions from 7.0.0 up to but not including 7.8.1, and versions below 6.10.15.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the API route /api/_info/config exposes sensitive information about activated licenses and features without requiring any privileges or user interaction.'}, {'type': 'paragraph', 'content': "This means unauthorized actors can access information about the system's state, leading to an information disclosure issue."}] [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Shopware instance exposes the /api/_info/config API route without authentication, which reveals sensitive license information.

You can use network scanning or HTTP request commands to test this exposure.

• Use curl to send a request to the vulnerable endpoint: curl -v http://<shopware-host>/api/_info/config
• Use tools like wget or HTTPie to check the response from the /api/_info/config route.
• Scan your network for Shopware instances and verify if this endpoint is accessible without authentication.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Shopware to a fixed version.

• Upgrade Shopware to version 7.8.1 or later if you are running a version >= 7.0.0 and < 7.8.1.
• Upgrade Shopware to version 6.10.15 or later if you are running a version below 6.10.15.

Until the upgrade can be performed, restrict access to the /api/_info/config endpoint to trusted users or internal networks to prevent unauthorized information disclosure.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is limited to confidentiality loss due to exposure of sensitive information.

It does not affect the integrity or availability of the system.

Attackers can gain unauthorized access to information about activated licenses and features, which could potentially aid in further attacks or reconnaissance.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0