CVE-2026-48014 Details
Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege check, so AclAnnotationValidator exits when route ACL metadata is absent and low-privileged users without order:update, order_transaction:update, or order_delivery:update can trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
A vulnerability exists in Shopware's Admin API order state transition endpoints, specifically in versions prior to 6.6.10.18 and 6.7.10.1. The issue arises because these endpoints do not properly enforce access control list (ACL) privileges, allowing low-privileged users to manipulate order states without the necessary permissions. This bypass can disrupt business operations by incorrectly altering order lifecycles and automating processes that should be controlled.
Users can update to Shopware versions 6.6.10.18 or 6.7.10.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopware/shopware/commit/86dff24ba500e16325742e59d20357f57a79c2af | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/commit/9f15faee704b61e8a96657024fa96c70b47ad082 | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/releases/tag/v6.6.10.18 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/releases/tag/v6.7.10.1 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/security/advisories/GHSA-f8q6-3g5w-jjr6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopware | >= 6.7.0.0, < 6.7.10.1 < 6.6.10.18 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |