CVE-2026-48010

6.5 Moyenne

Publiée le 17/07/2026 à 20:17 · Modifiée le 18/07/2026 à 02:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

Traduire en français

Produits concernés

shopware
shopware platform

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-269

Références

https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d
https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25
https://github.com/shopware/shopware/releases/tag/v6.6.10.18
https://github.com/shopware/shopware/releases/tag/v6.7.10.1
https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories