CVE-2026-48008 Details
Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
A privilege escalation vulnerability has been identified in Shopware versions prior to 6.6.10.18 and 6.7.10.1. The issue allows a non-admin API user with 'integration:create' ACL privilege to escalate privileges to full administrator rights. This is achieved by creating an integration with 'admin: true' through the Sync API endpoint 'POST /api/_action/sync'. The regular integration endpoint 'POST /api/integration' blocks this action, but the Sync API bypasses the necessary checks by directly writing to the database via the EntityWriter, exploiting the absence of write protection on the admin field in the integration definition.
The vulnerability has been patched in Shopware versions 6.6.10.18 and 6.7.10.1. Users should upgrade to these versions. For developers, the integration definition should be modified to include write protection for the admin field, similar to the existing protections for user and ACL role definitions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopware/shopware/commit/1e047f6d7fd9129271e28c1c9f1c272983c6f48f | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/commit/db5adff33ec30b648979cd1938c87f164f7b3073 | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/releases/tag/v6.6.10.18 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/releases/tag/v6.7.10.1 | [email protected] | BundleRelease NotesVendor |
| https://github.com/shopware/shopware/security/advisories/GHSA-gv8p-48fr-4fxg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopware | >= 6.7.0.0, < 6.7.10.1 < 6.6.10.18 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |