API Escalation Vulnerability in Shopware eCommerce Platform
CVE-2026-48008
6.5MEDIUM
What is CVE-2026-48008?
A vulnerability exists in the Shopware eCommerce platform that allows a non-admin API user with the integration:create ACL privilege to escalate their permissions to full administrator. By creating an integration with the parameter admin: true through the Sync API, unauthorized users can gain elevated access. Although the regular integration endpoint restricts this action, the SyncController's method inadvertently allows it due to inadequate write protection on the admin field. This issue is resolved in versions 6.6.10.18 and 6.7.10.1.
Affected Version(s)
platform < 6.6.10.18 < 6.6.10.18
platform >= 6.7.0.0, < 6.7.10.1 < 6.7.0.0, 6.7.10.1
shopware < 6.6.10.18 < 6.6.10.18