CVE-2026-48014

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description A vertical authorization bypass exists in the Admin API affecting order state transition features. The issue occurs because certain routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE ACL or perform explicit privilege checks. Consequently, the AclAnnotationValidator exits when route ACL metadata is absent, allowing authenticated users with low privileges—who lack order:update, order transaction:update, or order delivery:update permissions—to trigger state changes via StateMachineRegistry::transition() in SYSTEM SCOPE. This allows an attacker to manipulate order lifecycles, such as canceling or reopening orders, by making direct API calls to endpoints like '/api/ action/order/{orderId}/state/{transition}' and similar transaction or delivery transition routes, regardless of UI restrictions.

Recommendations Update Shopware to version 6.6.10.18. Update Shopware to version 6.7.10.1.