CVE-2026-48016: Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment ## Summary The Shopware Store API endpoint `/store-api/handle-payment`…

medium

Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

## Summary

The Shopware Store API endpoint `/store-api/handle-payment` contains an object-level authorization flaw that allows a low-privileged external user with a normal customer or guest context to trigger the payment flow for another user’s order by supplying a foreign `orderId`. The affected functionality is the Store API payment initiation and retry flow. The root cause is that the endpoint forwards the user-controlled `orderId` into the payment processing logic without verifying that the caller owns the referenced order or has passed the required guest-order authentication. As a result, payment attempts for foreign orders are accepted by the server, which can compromise the integrity of order and payment workflows.

## Description

Shopware exposes `/store-api/handle-payment` to initiate or retry the payment flow for an already created order. Under the normal order access model, customers should only be able to view or act on their own orders, and guest users should only be able to access guest orders after completing additional verification such as `deepLinkCode`, email address, and postal code. The Store API `/store-api/order` route follows this model: authenticated customers only see their own orders, and guest users are denied access unless guest-order authentication is performed. However, `/store-api/handle-payment` does not follow the same protection model. It only checks whether the supplied `orderId` exists and then directly forwards it into the payment processing flow. As a result, an attacker who cannot read orders through the intended protected route can still trigger the payment retry or payment initiation logic for another customer’s order as long as they know a valid foreign order ID. Although `orderId` is a UUID-based identifier and is not trivially guessable, it is used throughout storefront order flows such as checkout finish, account order pages, paymen

Affected

4 ranges

Vendor	Product	Version range	Fixed in
shopware	core	>= 0 < 6.6.10.18	6.6.10.18
shopware	core	>= 6.7.0.0 < 6.7.10.1	6.7.10.1
shopware	platform	>= 0 < 6.6.10.18	6.6.10.18
shopware	platform	>= 6.7.0.0 < 6.7.10.1	6.7.10.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.