N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-30150

CVE-2025-30150: Shopware 6 allows attackers to check for registered accounts through the store-api

Impact

Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop.

Using the store-api endpoint /store-api/account/recovery-password you get the response

{"errors":[{"status":"404","code":"CHECKOUT__CUSTOMER_NOT_FOUND","title":"Not Found","detail":"No matching customer for the email \u0022asdasfd@asdads.de\u0022 was found.","meta":{"parameters":{"email":"asdasfd@asdads.de"}}}]}

which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found.

Patches

Update to Shopware 6.6.10.3

Workarounds

For older versions of 6.5 or 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-30150

CVE-2025-30150:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
shopware/core	composer	= 6.7.0.0-rc1	6.7.0.0-rc2
shopware/platform	composer	= 6.7.0.0-rc1	6.7.0.0-rc2
shopware/core	composer	>= 6.6.0.0, <= 6.6.10.2	6.6.10.3
shopware/platform	composer	>= 6.6.0.0, <= 6.6.10.2	6.6.10.3
shopware/core	composer	<= 6.5.8.17	6.5.8.18
shopware/platform	composer	<= 6.5.8.17	6.5.8.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the sendRecoveryMail function within the SendPasswordRecoveryMailRoute.php file. Previously, this function would throw a CustomerException if an email address was not found, allowing an attacker to differentiate between registered and unregistered users. The patch modifies this behavior to catch the exception and return a generic success response, thereby obscuring whether the email exists in the system or not. The getCustomerByEmail function is also involved, as it's the source of the CustomerException, but the primary vulnerability is in how sendRecoveryMail handles this exception (or lack thereof, prior to the patch).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.