CVE-2026-32142

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Shopware is an open commerce platform. /api/_info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
shopwarecommercial>= 7.0.0, < 7.8.1; < 6.10.15

References

Timeline

Published
Mar 12, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-321436.5Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2CVE-2026-321447.4Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bCVE-2026-321457.5Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parCVE-2026-321467.8Improper path validation vulnerability in the Gleam compiler's handling of git dependencies allows arbitrary file system modification duringCVE-2026-321474.3Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an CVE-2026-321485.9Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass viCVE-2026-321497.3Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.CVE-2026-32155.4Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Islandora allows Cross-Site ScrCVE-2026-321507.0Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allowsCVE-2026-321516.5Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a netCVE-2026-321527.8Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-321537.8Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
CVE-2026-32142: Medium severity, CVSS 5.3 | Vulnix