What is the CVSS score of CVE-2026-25878?

CVE-2026-25878 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Froshadminer are affected by CVE-2026-25878?

Organizations using for Shopware Platform. should be aware of moderate risk from CVE-2026-25878, a missing authentication vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-25878?

Within 30 days: Identify affected systems running for Shopware Platform. and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Froshadminer CVE-2026-25878

MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-02-09 security-advisories@github.com

GHSA-f339-246p-wwjp

Authentication Bypass Froshadminer

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 28, 2026 - 00:18 nvd

Patch available

CVE Published

Feb 09, 2026 - 21:15 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.

AnalysisAI

Froshadminer versions up to 2.2.1 is affected by missing authentication for critical function (CVSS 5.3).

Technical ContextAI

This vulnerability (CWE-306: Missing Authentication for Critical Function) affects Froshadminer. FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.