CVE-2026-103905
7.5HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-306
Impact
Remote, unauthenticated attackers can cause a shop-wide denial of service by disabling all plugins, breaking payment and shipping integrations. Exploitation requires only a single unauthenticated HTTP request to the admin logout route.
Root cause
The administration backend middleware processes the plugin safe mode toggle parameter on the logout route before verifying if the requester is authenticated.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Check the vendor advisory at https://www.jtl-software.com/de/security/shop-maintenance-mode for the patched release; as an interim mitigation, block or restrict access to the admin logout endpoint and admin backend path at your reverse proxy or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the requesting user is authenticated. An unauthenticated remote attacker can therefore switch the shop's plugin safe mode on and off, which deactivates all installed plugins and their functionality, such as payment and shipping integrations, resulting in a shop-wide denial of service. The attack requires a single request and can be automated against many installations.