CVE-2023-34099
Improper mail validation in Shopware
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper mail validation in Shopware
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
- Record
CVE-2023-34099- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
EUVDEUVD-2023-1803
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
- Record
EUVD-2023-1803- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gh66-fp7j-98v5
Shopware improper mail validation vulnerability
Impact
The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.
Patches
We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
- Record
GHSA-gh66-fp7j-98v5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
NVD
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
- Record
CVE-2023-34099- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
OSV
Improper mail validation in Shopware
Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. This issue has been addressed in version 5.7.18 and users are advised to update. There are no known workarounds for this vulnerability.
- Record
CVE-2023-34099- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
OSVGHSA-gh66-fp7j-98v5
Shopware improper mail validation vulnerability
Impact
The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts.
Patches
We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18
For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html
References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
- Record
GHSA-gh66-fp7j-98v5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-754
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/shopwarePackagist |
5.1.4 to 5.7.17 | 5.7.18 |
shopware/shopwarePackagist |
5.1.4 up to 5.7.18, plus listed versions 5.3.0v5.1.4v5.1.5v5.1.6v5.2.0 Show 45 moreShow lessv5.2.0-BETA1v5.2.0-RC1v5.2.0-RC2v5.2.0-RC3v5.2.1v5.2.10v5.2.11v5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.25v5.2.26v5.2.27v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9v5.3.4v5.3.5v5.3.6v5.3.7v5.4.0v5.4.0-RC1v5.4.1v5.4.2v5.4.3v5.4.4v5.4.5v5.4.6v5.5.0v5.5.0-BETA1 |
5.7.18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-34099 is a medium vulnerability (CVSS 5.3) in Shopware, published June 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in shopware/shopware 5.7.18.
References
github.com/shopware/shopware/security/advisories/GHSA-gh66-fp7j-98v5
docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
shopware.com/en/changelog-sw5
nvd.nist.gov/vuln/detail/CVE-2023-34099
Left out here: 45 versions. The JSON record has them.