CVE-2026-103905 Details
Description
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.
A missing authorization vulnerability has been identified in JTL-Shop versions 5.3.0 through 5.8.1. The issue arises in the authentication middleware of the shop administration backend, which processes requests to toggle the plugin safe mode on the admin logout route without verifying if the user is authenticated. This flaw enables an unauthenticated remote attacker to switch the shop's plugin safe mode on or off, deactivating all installed plugins and their functionalities, including payment and shipping integrations. As a result, this vulnerability causes a shop-wide denial-of-service. The exploitation requires a single request and can be automated across multiple installations.
Users can update to JTL-Shop versions 5.8.2, 5.7.5, or 5.6.5, depending on their current version. For those unable to update, patch files are available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.jtl-software.com/de/security/shop-maintenance-mode | ENISA | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | ENISA |
Affected Products
| Product | Versions |
|---|---|
| JTL-Shop | >= 5.3.0, <= 5.8.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | ENISA |