User Recovery Vulnerability in Shopware Open Commerce Platform
CVE-2026-48009
6.8MEDIUM
What is CVE-2026-48009?
A low-privilege admin user in Shopware can exploit a flaw in the user recovery process. By leveraging specific API endpoints, such as POST /api/_action/user/user-recovery and PATCH /api/_action/user/user-recovery/password, an attacker can recover and abuse the password hash, allowing access to any admin account. This issue arises due to insufficient protection of the hash field in the Admin API. Specifically, the vulnerability stems from src/Core/System/User/Recovery/UserRecoveryDefinition.php not enforcing necessary access controls. It is crucial to update to versions 6.6.10.18 or 6.7.10.1 to mitigate this risk.
Affected Version(s)
platform < 6.6.10.18 < 6.6.10.18
platform >= 6.7.0.0, < 6.7.10.1 < 6.7.0.0, 6.7.10.1
shopware < 6.6.10.18 < 6.6.10.18