---
id: CVE-2026-31887
aliases:
  - GHSA-7vvp-j573-5584
title: >-
  Shopware: Unauthenticated data extraction possible through store-api.order
  endpoint
summary: >-
  Shopware: Unauthenticated data extraction possible through store-api.order
  endpoint
severity: high
cwe:
  - CWE-863
vendor: shopware
product: shopware/core
ecosystem: composer
affected:
  - 'shopware/core >= 6.7.0.0, < 6.7.8.1'
  - shopware/core < 6.6.10.15
  - 'shopware/platform >= 6.7.0.0, < 6.7.8.1'
  - shopware/platform < 6.6.10.15
patched:
  - shopware/core 6.7.8.1
  - shopware/core 6.6.10.15
  - shopware/platform 6.7.8.1
  - shopware/platform 6.6.10.15
published: '2026-03-11'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T07:05:34Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-7vvp-j573-5584'
references:
  - url: >-
      https://github.com/shopware/shopware/security/advisories/GHSA-7vvp-j573-5584
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31887'
  - url: 'https://github.com/advisories/GHSA-7vvp-j573-5584'
tags:
  - ghsa
  - composer
epss: 0.00394
epssPercentile: 0.30835
ingestedAt: '2026-09-10T07:40:24.113Z'
---

## Overview

### Summary

An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the `deepLinkCode` support on the `store-api.order` endpoint.

### Details

#### Data Exposure

Depending on the order payload configuration, attackers may retrieve:
- Customer names
- Billing address
- Shipping address
- Email addresses
- Ordered products
- Order values
- Order numbers
- Order dates
- Payment method information
- Shipping method information
- More customs, depending on the given associations in the request

#### Security Impact

This vulnerability allows:
- Unauthorized access to foreign customer order data
- Mass enumeration of recent orders
- Potential scraping of customer personal information

#### Limitation

No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).

### Impact

The code is present since ~2021. Likely every version since then is impacted for every store.

## Affected packages

- `shopware/core >= 6.7.0.0, < 6.7.8.1`
- `shopware/core < 6.6.10.15`
- `shopware/platform >= 6.7.0.0, < 6.7.8.1`
- `shopware/platform < 6.6.10.15`

## Remediation

Upgrade to a patched release:

- `shopware/core 6.7.8.1`
- `shopware/core 6.6.10.15`
- `shopware/platform 6.7.8.1`
- `shopware/platform 6.6.10.15`