CVE-2026-31887: 
PHP vulnerability analysis and mitigation

CVE-2026-31887 is an incorrect authorization vulnerability in Shopware, an open-source e-commerce platform, that allows unauthenticated attackers to access order data belonging to other customers. The flaw exists in the store-api.order endpoint's deepLinkCode support, where filter types are insufficiently validated for unauthenticated requests. It affects Shopware versions >= 6.7.0.0 and < 6.7.8.1, as well as all versions < 6.6.10.15. The vulnerability was disclosed on March 11, 2026, and carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.9 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the store-api.order endpoint does not properly validate filter types when processing requests from unauthenticated users leveraging the deepLinkCode feature, allowing them to bypass access controls intended to restrict order visibility to the owning customer. An attacker can craft API requests to the endpoint with manipulated filter parameters to retrieve orders belonging to arbitrary customers. The advisory notes the vulnerable code has been present since approximately 2021, suggesting a broad historical exposure window across many Shopware versions (GitHub Advisory, Github Advisory).

Successful exploitation enables unauthenticated, remote attackers to enumerate and extract sensitive customer order data from affected Shopware stores, including customer names, billing and shipping addresses, email addresses, ordered products, order values, order numbers, order dates, and payment and shipping method information. The vulnerability supports mass enumeration of recent orders and potential scraping of personally identifiable information (PII) at scale, posing significant privacy and regulatory compliance risks for store operators. There is no impact on integrity or availability, but the confidentiality impact is rated High for both the vulnerable and subsequent systems (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit if targeted. The EPSS score is approximately 0.041% (16th percentile), indicating a currently low but non-negligible probability of exploitation within 30 days. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing Shopware stores running versions prior to 6.7.8.1 or 6.6.10.15 using tools like Shodan, Censys, or by inspecting HTTP response headers and page metadata for Shopware version indicators.
2. Identify the vulnerable endpoint: Target the store-api.order endpoint (typically accessible at /store-api/order) which supports deepLinkCode-based unauthenticated access.
3. Craft a malicious filter request: Send an HTTP POST or GET request to the store-api.order endpoint with manipulated filter parameters that bypass the insufficient filter-type validation, omitting or substituting the expected customer-scoping filter.
4. Enumerate orders: Iterate over order identifiers or use broad filter criteria to retrieve order records belonging to other customers, extracting PII such as names, addresses, email addresses, and payment details from the API response.
5. Exfiltrate data at scale: Automate the enumeration process to scrape large volumes of customer order data from the store, potentially targeting all orders accessible through the endpoint (GitHub Advisory).

• Network: Unusual or high-volume unauthenticated POST/GET requests to /store-api/order from a single IP or rotating IP ranges; requests containing unexpected or broad filter parameters not typical of normal customer browsing.
• Logs: Web server or application access logs showing repeated unauthenticated calls to the store-api.order endpoint with varying filter values; absence of session tokens or authentication headers in requests to this endpoint.
• Application Behavior: API responses returning order data for multiple distinct customers from a single unauthenticated session; anomalous spikes in order API query volume outside of normal business hours (GitHub Advisory).

Shopware has released patched versions 6.7.8.1 (for the 6.7.x branch) and 6.6.10.15 (for the 6.6.x branch); upgrading to these versions is the primary recommended remediation (GitHub Advisory). If immediate patching is not feasible, operators should consider restricting unauthenticated access to the store-api.order endpoint at the web server or WAF level, or implementing additional authorization controls. Administrators should also review access logs to determine whether unauthorized order data access has already occurred and assess potential data breach notification obligations.

The vulnerability was published by Shopware's security team (mkraeml) via GitHub Security Advisories on March 11, 2026, with coordinated disclosure crediting reporter mromeike and coordinators ab-pknollmann and janschoepke (GitHub Advisory). A brief technical write-up was published by Infinitsec shortly after disclosure, highlighting the unauthenticated data extraction risk (Feedly). General community coverage was limited to automated CVE tracking feeds and databases, with no significant broader media or researcher commentary identified.