CVE-2026-32100 — swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes

CVE-2026-32100

swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes PUBLISHED

Description (CNA)

Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7.

Affected (CNA)

Vendor / product	Versions
swag / platform-security	affected >= 4.0.0, < 4.0.7; affected >= 3.0.0 < 3.0.12; affected < 2.0.16

CWE

CWE-200

References

https://github.com/shopware/shopware/security/advisories/GHSA-64rg-pgjv-4v33

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.