Shopware Core vulnerabilities

CVE-2023-22734 [MEDIUM] CWE-20 Shopware has Improper Input Validation issue in newsletter subscription Shopware has Improper Input Validation issue in newsletter subscription ### Impact The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process. ### Patches The problem has been fixed with 6.4.18.1 ### Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For t

CVE-2026-48010 [MEDIUM] CWE-269 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts `UserController::upsertUser()` writes user data in `SYSTEM_SCOPE` and does not filter the `admin` field. A non-admin API user with `user:create` or `user:update` ACL permission can set `admin: true` on new or existing users, escalating to full admin access. ## The Problem In `

CVE-2025-30151 [HIGH] CWE-20 Shopware allows Denial Of Service via password length Shopware allows Denial Of Service via password length ### Impact It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. ### Patches Update to Shopware 6.6.10.3 or 6.5.8.17 ### Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopwa

CVE-2023-22733 [LOW] CWE-117 Shopware's log module vulnerable to Improper Output Neutralization Shopware's log module vulnerable to Improper Output Neutralization ### Impact The log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access. ### Patches Update to the latest 6.4.18.1 version. ### Workarounds - For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a p

CVE-2026-48014 [MEDIUM] CWE-862 Shopware: Admin API ACL Bypass in Order State Transition Endpoints Shopware: Admin API ACL Bypass in Order State Transition Endpoints ## Summary This is a vertical authorization bypass in the Admin API affecting order state transition features (`/api/_action/order/{orderId}/state/{transition}` and similar transaction/delivery transition routes). The root cause is that the transition action routes do not declare required server-side ACL privileges, allowing low-pr

CVE-2021-37709 [MEDIUM] CWE-532 Insecure direct object reference of log files of the Import/Export feature Insecure direct object reference of log files of the Import/Export feature ### Impact Insecure direct object reference of log files of the Import/Export feature ### Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Worka

CVE-2024-22407 [MEDIUM] CWE-284 Broken Access Control order API in Shopware Broken Access Control order API in Shopware ### Impact In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. ### Patches Update to Shopware 6.5.7.4 ### Workarounds For older version

CVE-2024-42354 [MEDIUM] CWE-284 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api ### Impact The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. The processing of the Criteria did not cons

CVE-2026-31888 [MEDIUM] CWE-204 CVE-2026-31888: Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint Shopware is an open commerce platform. Prior to 6.7.8.1 and 6.6.10.15, the Store API login endpoint (POST /store-api/account/login) returns different error codes depending on whether the submitted email address belongs to a registered customer (CHECKOUT__CUSTOMER_AUTH_BAD_CREDENTIALS) or is unknown (CHECKOUT__CUSTOMER_NOT_FOUND). The "not found" resp

CVE-2022-24871 [HIGH] CWE-918 Server-Side Request Forgery (SSRF) in Shopware Server-Side Request Forgery (SSRF) in Shopware ### Impact The attacker can abuse the Admin SDK functionality on the server to read or update internal resources. ### Patches We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Workarounds For older versions

CVE-2025-30150 [MEDIUM] CWE-204 Shopware 6 allows attackers to check for registered accounts through the store-api Shopware 6 allows attackers to check for registered accounts through the store-api ### Impact Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint `/store-api/account/recovery-password` you get the response ``` {"errors":[{"status":"404","code":"CHECKOUT__CUSTOMER_NOT_FOUND","title":"Not F

CVE-2026-48015 [MEDIUM] CWE-79 Shopware: Stored XSS via SVG file upload — no SVG sanitization Shopware: Stored XSS via SVG file upload — no SVG sanitization SVG files are in the `allowed_extensions` whitelist and can be uploaded by any admin user via the media manager. There is zero SVG content sanitization anywhere in the upload pipeline. A malicious SVG with JavaScript (`onload`, ``, ``) executes in the context of the Shopware domain when accessed. ## The Problem In `src/Core/Framework/Reso

CVE-2024-31447 [MEDIUM] CWE-613 Shopware Improper Session Handling in store-api account logout Shopware Improper Session Handling in store-api account logout ### Impact When a authentificated request is made to `POST /store-api/account/logout`, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on `CustomerLogoutEvent` and invalidates the session additionally. ### Patches The problem has been fix

CVE-2022-24746 [MEDIUM] CWE-79 HTML injection possibility in voucher code form in Shopware HTML injection possibility in voucher code form in Shopware ### Impact HTML injection possibility in voucher code form ## Patches Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ## Workarounds For older versions of 6.

CVE-2025-32378 [LOW] CWE-1188 Shopware default newsletter opt-in settings allow for mass sign-up abuse Shopware default newsletter opt-in settings allow for mass sign-up abuse ### Impact Currently the default settings for double-opt-in allow for mass unsolicited newsletter sign-ups without confirmation. Default settings are: Newsletter: Double Opt-in - active Newsletter: Double opt-in for registered customers - disabled Log-in & sign-up: Double opt-in on sign-up - disabled With these sett

CVE-2022-24747 [MEDIUM] CWE-200 HTTP caching is marking private HTTP headers as public in Shopware HTTP caching is marking private HTTP headers as public in Shopware ### Impact HTTP caching is marking private HTTP headers as public ## Patches Fixed in recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ## Workarounds For older versions of 6.1

CVE-2026-48013 [MEDIUM] CWE-918 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation ## Summary The `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel `uploadFromURL` flow validates target IPs against private/reserved ranges via `FileUrlValidator`, the `linkURL` flow only performs a URL for

CVE-2026-48016 [MEDIUM] CWE-290 Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment ## Summary The Shopware Store API endpoint `/store-api/handle-payment` contains an object-level authorization flaw that allows a low-privileged external user with a normal customer or guest context to trigger the payment flow for another user’s order by supplying a foreign `orderId`. The a

CVE-2026-48012 [MEDIUM] CWE-601 Shopware SSO referer trust leading to an arbitrary redirect target Shopware SSO referer trust leading to an arbitrary redirect target ## Description This report describes an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the endpoint is reached without the expected SSO session state, the application falls back to the request's `Referer` header and uses that value as the redirect destination. In the validated behavior, the s

CVE-2021-37710 [HIGH] CWE-79 Cross-Site Scripting via SVG media files Cross-Site Scripting via SVG media files ### Impact Cross-Site Scripting via SVG media files ### Patches We recommend updating to the current version 6.4.3.1. You can get the update to 6.4.3.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/en/download/#shopware-6 ### Workarounds For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a