CVE-2025-30150: Shopware Information Disclosure Flaw

CVE-2025-30150 Overview

CVE-2025-30150 is an account enumeration vulnerability in Shopware 6, an open commerce platform built on Symfony Framework and Vue. The flaw resides in the /store-api/account/recovery-password endpoint of the store-api. Attackers can query this endpoint with arbitrary email addresses and observe response differences that reveal whether an account exists. The endpoint returns distinct responses for registered versus unregistered email addresses, enabling unauthenticated attackers to build lists of valid customer accounts. Shopware addressed the issue in versions 6.6.10.3 and 6.5.8.17. This weakness is classified as [CWE-204: Observable Response Discrepancy].

Critical Impact
Unauthenticated attackers can enumerate valid customer email addresses across any Shopware 6 storefront, enabling targeted phishing, credential stuffing, and account takeover campaigns.

Affected Products

Shopware 6 versions prior to 6.6.10.3
Shopware 6 versions prior to 6.5.8.17
Shopware 6.7.0.0 release candidate 1

Discovery Timeline

2025-04-08 - CVE-2025-30150 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30150

Vulnerability Analysis

The vulnerability stems from inconsistent response behavior in the Shopware store-api password recovery workflow. When a client submits an email address to /store-api/account/recovery-password, the endpoint returns a clearly distinguishable response depending on whether the email is associated with an active customer account. A success response indicates a registered account, while an alternate response indicates no matching account exists.

This observable discrepancy converts the password recovery function into a customer database oracle. Attackers can iterate through email lists to identify valid accounts on any Shopware storefront without authentication or rate-limiting friction visible at the protocol level. The endpoint is exposed on the public store-api, making enumeration accessible to any network-based attacker.

Root Cause

The root cause is a business logic flaw in the recovery-password handler. Secure password recovery implementations return uniform responses regardless of account existence to prevent information leakage. The Shopware endpoint instead branches its response logic on the presence of a matching customer record, exposing internal state to the requester.

Attack Vector

An unauthenticated attacker sends HTTP POST requests to /store-api/account/exists or /store-api/account/recovery-password with candidate email addresses. By comparing the HTTP status codes or JSON response bodies for known-valid and known-invalid emails, the attacker categorizes each address. Automated scripts can process bulk email lists sourced from prior breaches, producing verified customer rosters for downstream phishing or credential stuffing campaigns.

Detection Methods for CVE-2025-30150

Indicators of Compromise

High-volume POST requests to /store-api/account/recovery-password from a single client IP or narrow IP range
Sequential requests carrying distinct email addresses with minimal delay between calls
Unusual User-Agent strings or missing browser fingerprint headers on store-api recovery requests
Spikes in 200 versus 404 response ratios on the recovery-password endpoint

Detection Strategies

Ingest Shopware web server access logs into a SIEM and baseline normal recovery-password request volumes per source IP
Alert on any client exceeding a defined threshold of recovery-password requests within a rolling time window
Correlate recovery-password enumeration bursts with subsequent login attempts against the same accounts to identify credential stuffing follow-on activity

Monitoring Recommendations

Instrument the store-api with structured logging that captures request path, source IP, and response outcome for each recovery attempt
Monitor Web Application Firewall (WAF) telemetry for automated tooling signatures targeting the store-api
Track the geographic and ASN distribution of clients hitting authentication-adjacent endpoints to surface anomalous traffic

How to Mitigate CVE-2025-30150

Immediate Actions Required

Upgrade Shopware 6.6.x installations to version 6.6.10.3 or later
Upgrade Shopware 6.5.x installations to version 6.5.8.17 or later
For Shopware 6.4.x deployments, install the vendor-provided security plugin that backports the fix
Review store-api access logs for evidence of prior enumeration activity and notify affected customers if abuse is confirmed

Patch Information

Shopware published the fix in the GitHub Security Advisory GHSA-hh7j-6x3q-f52h. The patched versions unify the response behavior of the recovery-password endpoint so that identical output is returned regardless of whether the submitted email corresponds to an existing account. Shopware recommends upgrading to the latest release for the full range of security and functional improvements.

Workarounds

Apply rate limiting at the reverse proxy or WAF layer to cap the number of recovery-password requests per source IP
Enforce CAPTCHA challenges on the recovery-password workflow to disrupt automated enumeration
Restrict store-api access from known abusive IP ranges and hosting provider ASNs pending upgrade

bash

# Upgrade Shopware via Composer to a patched release
composer require shopware/core:~6.6.10.3 --update-with-dependencies
bin/console system:update:finish
bin/console cache:clear