Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

frosh/adminer-platform

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9PackagistPublished

    FroshAdminer Adminer UI is accessible without admin session

    CVE-2026-25878 · GHSA-f339-246p-wwjp

    Affected
    • Packagist frosh/adminer-platform < 2.2.1
    Fixed in
    2.2.1· Vendor fix available
    Issue
    Unauthenticated access to Adminer UI Details The Adminer route (/admin/adminer) was accessible without Shopware admin authentication. The route was configured with authrequired=false and performed no session validation, exposing the Adminer UI to unauthenticated users. Note: Database access itself requires credentials that are only set through the ACL-protected API endpoint. Direct database access without prior admin login is not possible through this vulnerability alone. Impact An unauthenticated user could access the Adminer interface, potentially disclosing version information or exploiting Adminer-specific vulnerabilities. Patches Version 2.2.1 adds session validation. The Adminer route now verifies an authenticated session flag before rendering — returning HTTP 403 otherwise. Workarounds Deactivate or uninstall the plugin.

    Recommended action: Upgrade to 2.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →