CVE-2026-48010

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description In the UserController::upsertUser() function within src/Core/Framework/Api/Controller/UserController.php, raw user data is written in SYSTEM SCOPE without filtering the admin field. This allows a non-admin API user possessing user:create or user:update ACL permissions to set the admin variable to true for new or existing users, resulting in a privilege escalation to full administrator access. This occurs because SYSTEM SCOPE bypasses the AclWriteValidator, and the UserController lacks the isAdmin() check present in the IntegrationController::upsertIntegration() function.

Recommendations Update Shopware to version 6.6.10.18 or newer. Update Shopware to version 6.7.10.1 or newer.