Authorization bypass through user-controlled key in Shopware - CVE-2026-48016
Published: May 20, 2026
Vulnerability identifier: #VU131952
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48016
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to trigger payment attempts for another user's order.
The vulnerability exists due to improper access control in /store-api/handle-payment when processing a user-supplied orderId. A remote user can submit a foreign orderId to trigger payment attempts for another user's order.
Guest context is sufficient, and the issue affects payment initiation and retry flows for orders not owned by the caller.
Affected software
Shopware
How to mitigate CVE-2026-48016
Install security update from vendor's website.
Shopware - addressed in versions 6.6.10.18, 6.7.10.1