Missing Authorization in Shopware - CVE-2026-48008
Published: May 20, 2026
Vulnerability identifier: #VU131954
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-48008
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges.
The vulnerability exists due to missing authorization in the Sync API integration write path when handling crafted Sync API requests to create integrations. A remote privileged user can create an integration with the admin field set to true via POST /api/_action/sync to escalate privileges.
The dedicated integration endpoint applies an admin check, but the Sync API writes directly through the DAL EntityWriter, and the integration entity definition lacks write protection on the admin field.
Affected software
Shopware
How to mitigate CVE-2026-48008
Install security update from vendor's website.
Shopware - addressed in versions 6.6.10.18, 6.7.10.1