Every CVE Search/ Get API key

CVE-2021-32716

Internal hidden fields are visible on to many associations in admin api

4.4 MediumFix available

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.11%Up 0.3 points since Jun 25, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.4

Internal hidden fields are visible on to many associations in admin api

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
CVE-2021-32716
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2021-1993 4.4

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
EUVD-2021-1993
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-68v9-3jjq-rvp4 4.4

Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
GHSA-68v9-3jjq-rvp4
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-863
Updated
2026-11-02
GitHub AdvisoriesGHSA-gpmh-g94g-qrhr No score

Internal hidden fields are visible on to many associations in admin api

Impact

The admin api has exposed some internal hidden fields when an association has been loaded with a to many reference

Patches

We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

Record
GHSA-gpmh-g94g-qrhr
Updated
2026-11-02
NVD 4.4

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
CVE-2021-32716
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness
CWE-200, CWE-863
Updated
2026-11-02
OSV 4.9

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
CVE-2021-32716
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-68v9-3jjq-rvp4 4.4

Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.

Record
GHSA-68v9-3jjq-rvp4
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200, CWE-863
Updated
2026-11-02
OSVGHSA-gpmh-g94g-qrhr No score

Internal hidden fields are visible on to many associations in admin api

Impact

The admin api has exposed some internal hidden fields when an association has been loaded with a to many reference

Patches

We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

Record
GHSA-gpmh-g94g-qrhr
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shopware/platform
Packagist
 through 6.4.1.0
6.4.1.1
shopware/core
Packagist
 through 6.4.1.0
6.4.1.1
shopware/platform
Packagist
 before 6.4.1.1, plus listed versions
6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1
Show 31 moreShow less
6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.0v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3
6.4.1.1
shopware/core
Packagist
 before 6.4.1.1, plus listed versions
6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1
Show 31 moreShow less
6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.0v6.0.0+ea2v6.1.0v6.1.0-rc1v6.1.0-rc2v6.1.0-rc3v6.1.0-rc4v6.1.1v6.1.2v6.1.3v6.1.4v6.1.5v6.1.6v6.2.0v6.2.0-RC1v6.2.1v6.2.2v6.2.3
6.4.1.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-32716 is a medium vulnerability (CVSS 4.4) in Runzero Platform, published June 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.11%, the 66th percentile. Fixed in shopware/platform 6.4.1.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open