SB20260917249 - Multiple vulnerabilities in Shopware

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260917249

SB20260917249 - Multiple vulnerabilities in Shopware

Published: September 17, 2026

Security Bulletin ID SB20260917249
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Medium 60% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper authorization in Administration API entity cloning when cloning users. A remote privileged user can provide values for protected fields to escalate privileges.

Exploitation requires the user:create permission.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in the profile update functionality when modifying nested properties of their own account. A remote user can modify protected account properties to escalate privileges.

Exploitation requires access to the user's own profile through the user_change_me permission.


3) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose arbitrary data from the underlying database.

The vulnerability exists due to insufficient input validation in Store API aggregation handling when processing Store API aggregation input. A remote attacker can send specially crafted aggregation input to disclose arbitrary data from the underlying database.

The issue requires PHP versions before 8.4 with PDO MySQL emulated prepares enabled.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information and enable further compromise.

The vulnerability exists due to missing authorization in webhook event-level authorization checks when creating webhooks for subscribed events. A remote user can create a webhook subscribed to an event to disclose sensitive information and enable further compromise.

Exposed event data may include customer, order, business-process, email-related, and account-recovery information.


5) Improper Enforcement of Behavioral Workflow (CVE-ID: N/A)

CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to activate unauthorized newsletter subscriptions.

The vulnerability exists due to improper enforcement of the double-opt-in confirmation flow in the Shopware newsletter activation feature when processing Store API newsletter activation requests. A remote attacker can submit a newsletter activation request without proving control of the email address to activate unauthorized newsletter subscriptions.

Email addresses belonging to existing customers can be subscribed.


Remediation

Install update from vendor's website.

References