Authentication Bypass Vulnerability in JTL-Shop Administration Backend
CVE-2026-103905

8.7HIGH

Key Information:

Vendor

Jtl-software Gmbh

Status
Jtl-shop
Vendor
CVE Published:
14 October 2026

What is CVE-2026-103905?

The authentication middleware of the JTL-Shop administration backend contains a flaw that allows unauthenticated remote attackers to manipulate the plugin safe mode toggle during admin logout. By exploiting this vulnerability, attackers can enable or disable all plugins, disrupting essential functionalities such as payment and shipping integrations, resulting in a shop-wide service denial. This attack method only requires a single request and can be executed against multiple installations, posing a significant risk to online vendors relying on JTL-Shop.

Affected Version(s)

JTL-Shop 5.3.0 < 5.6.5

JTL-Shop 5.7.0 < 5.7.5

JTL-Shop 5.8.0 < 5.8.2

References

https://www.jtl-software.com/de/security/shop-maintenance...
vendor-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Elkaño
.