CVE-2026-48008

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description A non-admin API user with integration:create ACL privilege can escalate their privileges to full administrator. This is possible by creating an integration with the admin variable set to true via the Sync API endpoint POST /api/ action/sync. While the standard integration endpoint POST /api/integration blocks this action, the Sync API bypasses this check by routing writes through the SyncService to EntityWriter::upsert(). The issue stems from the IntegrationDefinition.php file lacking WriteProtection on the admin field, allowing the Sync API to write to it without restriction. An attacker achieving this escalation gains complete admin API access, enabling the exfiltration of personally identifiable information (PII) and the creation of a persistent backdoor.

Recommendations Update to version 6.6.10.18. Update to version 6.7.10.1.