CVE-2026-48016

Name of the Vulnerable Software and Affected Versions Shopware versions prior to 6.6.10.18 Shopware versions prior to 6.7.10.1

Description An object-level authorization flaw exists in the Store API endpoint '/store-api/handle-payment' within the HandlePaymentMethodRoute.php and PaymentProcessor.php files. The endpoint accepts a user-controlled orderId and initiates the payment flow without verifying if the caller owns the order or has completed the required guest-order authentication. While the '/store-api/order' route correctly enforces ownership, this endpoint only checks if the orderId exists. An attacker with a normal customer or guest context can trigger payment initiation or retry flows for another user's order if they possess a valid orderId. Although orderId is a UUID, it is used as a business object identifier in various storefront flows and should not be treated as a secret authorization token. This flaw can lead to unauthorized payment attempts and compromise the integrity of order and payment workflows.

Recommendations Update Shopware to version 6.6.10.18. Update Shopware to version 6.7.10.1. As a temporary workaround, restrict access to the '/store-api/handle-payment' endpoint to ensure only authorized users can access it.