CVE-2025-32378 - CVE House
Back to Database
Status published Medium CVE-2025-32378

Shopware's default newsletter opt-in settings allow for mass sign-up abuse

Vulnerability Description

Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are Newsletter: Double Opt-in set to active, Newsletter: Double opt-in for registered customers set to disabled, and Log-in & sign-up: Double opt-in on sign-up set to disabled. With these settings, anyone can register an account on the shop using any e-mail-address and then check the check-box in the account page to sign up for the newsletter. The recipient will receive two mails confirming registering and signing up for the newsletter, no confirmation link needed to be clicked for either. In the backend the recipient is set to “instantly active”. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-32378

Credits & Attribution

No credits recorded in the NVD database.

References

More from shopware

View All →
CVE-2025-67648
Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page
High 7.1
CVE-2025-30151
Shopware allows Denial Of Service via password length
High 7.5
CVE-2025-30150
Shopware 6 allows attackers to check for registered accounts through the store-api
Medium 5.5
CVE-2024-42357
Shopware vulnerable to blind SQL-injection in DAL aggregations
High 7.3
CVE-2024-42356
Shopware vulnerable to Server Side Template Injection in Twig using Context functions
High 8.3

Affected Vendor

Affected Software

shopware
Vulnerable Versions:
< 6.5.8.17, >= 6.6.0.0, < 6.6.10.3, >= 6.7.0.0-rc1, < 6.7.0.0-rc2

Timeline

Official Publish: April 9th, 2025
Last Modified: April 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-799

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.