Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Published Jul 17, 2026
6.5
MEDIUMCVSS 3.1
EPSS 0.39%
Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege check, so AclAnnotationValidator exits when route ACL metadata is absent and low-privileged users without order:update, order_transaction:update, or order_delivery:update can trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Affected products
-
- Version < 6.6.10.18StatusaffectedConstraints-
- Version >= 6.7.0.0, < 6.7.10.1StatusaffectedConstraints-
- Version
-
- Version < 6.6.10.18StatusaffectedConstraints-
- Version >= 6.7.0.0, < 6.7.10.1StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://github.com/advisories/GHSA-f8q6-3g5w-jjr6 Advisory
- https://github.com/shopware/shopware/commit/86dff24ba500e16325742e59d20357f57a79c2af x_refsource_MISC
- https://github.com/shopware/shopware/commit/9f15faee704b61e8a96657024fa96c70b47ad082 x_refsource_MISC
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18 x_refsource_MISC
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1 x_refsource_MISC
- https://github.com/shopware/shopware/security/advisories/GHSA-f8q6-3g5w-jjr6 x_refsource_CONFIRM
| Link | Providers | Tags |
|---|---|---|
| https://github.com/advisories/GHSA-f8q6-3g5w-jjr6 | Advisory | |
| https://github.com/shopware/shopware/commit/86dff24ba500e16325742e59d20357f57a79c2af | x_refsource_MISC | |
| https://github.com/shopware/shopware/commit/9f15faee704b61e8a96657024fa96c70b47ad082 | x_refsource_MISC | |
| https://github.com/shopware/shopware/releases/tag/v6.6.10.18 | x_refsource_MISC | |
| https://github.com/shopware/shopware/releases/tag/v6.7.10.1 | x_refsource_MISC | |
| https://github.com/shopware/shopware/security/advisories/GHSA-f8q6-3g5w-jjr6 | x_refsource_CONFIRM |
Change history (0)
No recorded changes yet.