CVE-2026-25878 MEDIUM

CVE-2026-25878: FroshAdminer Adminer UI is accessible without admin session

Vendor Friendsofshopware

Product FroshPlatformAdminer

Weakness CWE-306 · Missing auth

Published February 9, 2026

Last update February 10, 2026

View on NVD All CVEs

CVSS base score

6.9/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

FroshAdminer is the Adminer plugin for Shopware Platform. Prior to 2.2.1, the Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with auth_required=false and performed no session validation, exposing the Adminer UI to unauthenticated users. This vulnerability is fixed in 2.2.1.

Key dates

02Disclosure timeline

February 9, 2026 CVE published

February 10, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25878 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2026-50085 Aqara Board IoT insecure debug API CVE-2026-3053 DataLinkDC dinky OpenAPI Endpoint AppConfig.java addInterceptors missing authentication CVE-2026-3611 Honeywell IQ4x BMS Controller Missing authentication for critical function CVE-2025-11198 Security Director Policy Enforcer: An unrestricted API allows a network-based unauthenticated attacker to deploy malicious vSRX images to VMWare NSX Server CVE-2022-32157 Splunk Enterprise deployment servers allow unauthenticated forwarder bundle downloads