CVE-2026-48016 Details
Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
A vulnerability in the Shopware Store API's payment handling endpoint allows unauthorized users to trigger payment processes for orders that do not belong to them. This issue affects Shopware versions prior to 6.6.10.18 and 6.7.10.1. The vulnerability arises because the endpoint accepts a user-controlled order ID and forwards it to the payment processing logic without verifying order ownership or guest-order authentication. As a result, normal customers or guests can initiate payments for other users' orders, disrupting the integrity of order and payment workflows.
Users can update to Shopware versions 6.6.10.18 or 6.7.10.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopware/shopware/commit/69dd5b6cb01d3c2aea49ac29dd4512a87836ac3f | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/commit/df15f2e607dcf9ebc4a26ec622ffcf452dc25090 | [email protected] | Source CodeVendor |
| https://github.com/shopware/shopware/releases/tag/v6.6.10.18 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/releases/tag/v6.7.10.1 | [email protected] | Release NotesVendor |
| https://github.com/shopware/shopware/security/advisories/GHSA-9v5m-39wh-5chq | [email protected] | AdvisoryRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopware | >= 6.7.0.0, < 6.7.10.1 < 6.6.10.18 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |