AIKIDO-2026-217870

aimeos/aimeos-core is vulnerable to Information Disclosure

Information Disclosure Pre-CVE Published Yesterday

Medium Risk

This Affects:

aimeos/aimeos-core

2013.07.0 - 2022.10.21

Fixed in 2022.10.22

2023.04.1 - 2023.10.28

Fixed in 2023.10.29

2024.04.1 - 2024.10.18

Fixed in 2024.10.19

2025.04.1 - 2025.10.7

Fixed in 2025.10.8

2026.04.1 - 2026.04.4

Fixed in 2026.04.5

Are you affected? Scan for Free

TL;DR

The customer item's toArray() method includes the raw password hash under customer.password when a caller requests private mode output. The customer manager also includes that column in its searchable attribute configuration and SQL select queries, so private mode serialization and searches by that attribute return the stored password hash. The patch removes the password hash from array output, JSON output, and the searchable configuration, and only overwrites the stored hash on update when a new password is supplied.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

aimeos/aimeos-core is vulnerable to Information Disclosure in versions 2013.07.0 - 2022.10.21, 2023.04.1 - 2023.10.28, 2024.04.1 - 2024.10.18, 2025.04.1 - 2025.10.7 and 2026.04.1 - 2026.04.4.