p PatchFirst

CVE-2026-25878

CVE-2026-25878 · FroshAdminer Adminer UI is accessible without admin session

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.

CVSS 6.9 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • froshplatformadminer

    Versions
    • < 2.2.1: Affected

    No fix published

  • frosh/adminer-platform Packagist

    Versions
    • 0.1.0
    • 0.1.1
    • 0.1.2
    • 0.2.0
    • 0.2.1
    • 0.3.0
    • 0.3.1
    • 0.3.2
    • 0.3.3
    • 0.3.4
    • 1.0.0
    • 1.0.1
    • 2.0.0
    • 2.1.0
    • 2.1.1
    • 2.2.0
    Affected ranges
    • ECOSYSTEM: < 2.2.1

    Update to 2.2.1

Original sources

Check your server →