{"id":"CVE-2026-25878","aliases":["GHSA-f339-246p-wwjp"],"url":"https://o3.security/vulnerability/CVE-2026-25878","summary":"FroshAdminer Adminer UI is accessible without admin session","details":"### Summary\nUnauthenticated access to Adminer UI\n\n### Details\nThe Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users.\n\nNote: Database access itself requires credentials that are only set through the ACL-protected API endpoint. Direct database access without prior admin login is not possible through this vulnerability alone.\n\n### Impact\nAn unauthenticated user could access the Adminer interface, potentially disclosing version information or exploiting Adminer-specific vulnerabilities.\n\n### Patches\nVersion 2.2.1 adds session validation. The Adminer route now verifies an authenticated session flag before rendering — returning HTTP 403 otherwise.\n\n### Workarounds\nDeactivate or uninstall the plugin.","published":"2026-02-09T20:53:23.818Z","modified":"2026-08-12T03:51:08.323404358Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"frosh/adminer-platform","fixedVersion":"2.2.1"}],"fix":{"url":"https://github.com/FriendsOfShopware/FroshPlatformAdminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b","label":"FriendsOfShopware/FroshPlatformAdminer@c4dd6c3"},"references":[{"type":"WEB","url":"https://github.com/FriendsOfShopware/FroshPlatformAdminer/releases/tag/2.2.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25878.json"},{"type":"ADVISORY","url":"https://github.com/FriendsOfShopware/FroshPlatformAdminer/security/advisories/GHSA-f339-246p-wwjp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25878"},{"type":"FIX","url":"https://github.com/FriendsOfShopware/FroshPlatformAdminer/commit/c4dd6c3462af178b3a7d146d3c651c2c253e902b"},{"type":"PACKAGE","url":"https://github.com/FriendsOfShopware/FroshPlatformAdminer"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.323404358Z"}}