CVE-2026-48016

4.3 Moyenne

Publiée le 17/07/2026 à 20:17 · Modifiée le 20/07/2026 à 22:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

Traduire en français

Produits concernés

shopware
shopware platform

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/shopware/shopware/commit/69dd5b6cb01d3c2aea49ac29dd4512a87836ac3f
https://github.com/shopware/shopware/commit/df15f2e607dcf9ebc4a26ec622ffcf452dc25090
https://github.com/shopware/shopware/releases/tag/v6.6.10.18
https://github.com/shopware/shopware/releases/tag/v6.7.10.1
https://github.com/shopware/shopware/security/advisories/GHSA-9v5m-39wh-5chq

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories