CVE-2026-32100 - swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes · CoreCVE

Back Back to CVE browser

MEDIUM

swag/platform-security: `/api/_info/config` route exposes information about licenses and active security fixes

Published Mar 12, 2026

5.3

MEDIUM

CVSS 3.1

EPSS 0.33%

Description

Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7.

Affected products

Vendor Swag Product Platform-Security Default
n/a
- Version
  < 2.0.16
  Status
  affected
  Constraints
  -
- Version
  >= 3.0.0 < 3.0.12
  Status
  affected
  Constraints
  -
- Version
  >= 4.0.0, < 4.0.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Platform-Security

n/a

Version	Status	Constraints
< 2.0.16	affected	-
>= 3.0.0 < 3.0.12	affected	-
>= 4.0.0, < 4.0.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (1)

https://github.com/shopware/shopware/security/advisories/GHSA-64rg-pgjv-4v33
x_refsource_CONFIRM

Link	Providers	Tags
https://github.com/shopware/shopware/security/advisories/GHSA-64rg-pgjv-4v33		x_refsource_CONFIRM

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Mar 12, 2026

Updated Mar 13, 2026

Reserved Mar 10, 2026

Link CVE-2026-32100

CISA Vulnrichment

Updated Mar 13, 2026

Status Deferred

Modified Jun 17, 2026

Link CVE-2026-32100

Severity n/a

Public date n/a

Links CVE-2026-32100