Race Condition Vulnerability in Shopware's Voucher System
CVE-2025-7954

6MEDIUM

Key Information:

Vendor

Shopware

Status
Shopware
Vendor
CVE Published:
6 August 2025

What is CVE-2025-7954?

A race condition vulnerability has been discovered in the voucher system of Shopware version 6.6.10.4. This flaw allows attackers to circumvent the designed restrictions on voucher usage, potentially enabling them to exceed the limitations set for vouchers. This could lead to unauthorized discounts or benefits, posing a significant risk to the integrity of the voucher management system.

Affected Version(s)

Shopware 6.6.x

Shopware 6.7.x

References

https://github.com/shopware/shopware/issues/11245
issue-tracking

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Timo MĂĽller
.