~ / search / GHSA-f339-246p-wwjp

GHSA-f339-246p-wwjp

FroshAdminer Adminer UI is accessible without admin session

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-25878

Packages

EcosystemPackageAffectedFixed in
Packagist frosh/adminer-platform < 2.2.1 2.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary Unauthenticated access to Adminer UI ### Details The Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. Note: Database access itself requires credentials that are only set through the ACL-protected API endpoint. Direct database access without prior admin login is not possible through this vulnerability alone. ### Impact An unauthenticated user could access the Adminer interface, potentially disclosing version information or exploiting Adminer-specific vulnerabilities. ### Patches Version 2.2.1 adds session validation. The Adminer route now verifies an authenticated session flag before rendering — returning HTTP 403 otherwise. ### Workarounds Deactivate or uninstall the plugin.

References

External links from the advisory. They lead to third-party sites.