Shopware 6 Account Enumeration Vulnerability via Store API

A vulnerability in Shopware 6 allows attackers to verify if an email address is associated with an account by using the store-api endpoint '/store-api/account/recovery-password'. This issue affects Shopware versions 6.6.0.0 through 6.6.10.2, 6.7.0.0-rc1, and 6.5.8.17. The vulnerability is rooted in the way the store API handles account recovery requests, providing distinct responses based on account existence.

Impact

Exploitation of this vulnerability allows for account enumeration by revealing whether a specific email address is associated with an account.

Remediation

Users can update to Shopware version 6.6.10.3, 6.7.0.0-rc2, or 6.5.8.18. For those using older versions of 6.4, corresponding security measures are available via a plugin.