CVE-2026-48011
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2026-48011 is a low-severity Observable Timing Discrepancy (CWE-208) vulnerability. Its CVSS base score is 3.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-36120
Vulnerability Data
Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.18 and 6.7.10.1 fix the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables username enumeration of admin accounts via observable timing discrepancy (CWE-208).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the root cause by requiring prompt application of the vendor patch that eliminates the observable timing discrepancy during username validation.
Requires analysis and mitigation of covert timing channels that could leak administrator usernames through response-time differences.
Enforces access decisions without permitting side-channel leakage of account existence information via timing.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require constant-time implementations that eliminate observable timing discrepancies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Consistent reference clocks limit the attacker's ability to measure or manipulate timing differences that could reveal internal state or processing paths.