Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability allows a non-admin API user to gain full administrator privileges. This is achieved by exploiting the Sync API endpoint (/api/_action/sync), which is handled by the Shopware\Core\Framework\Api\Controller\SyncController::sync method. This method allows users with the integration:create permission to create or update entities.
The root cause of the vulnerability lies in the Shopware\Core\System\Integration\IntegrationDefinition. The admin field, which determines if an integration has administrative privileges, was defined without any write protection. This meant that the generic SyncController, unlike the more specific IntegrationController, would write to this field without checking if the user context was authorized to do so.
The exploit involves sending a POST request to /api/_action/sync with a payload to create a new integration and setting its admin property to true. Because the admin field in IntegrationDefinition::defineFields was not protected, the system would process this request, creating an integration with full admin rights.
The patch addresses this by adding a WriteProtected(Context::SYSTEM_SCOPE) flag to the admin field in IntegrationDefinition::defineFields. This ensures that only processes running with system-level context can modify the admin flag, effectively closing the privilege escalation loophole through the Sync API.
Shopware\Core\Framework\Api\Controller\SyncController::syncsrc/Core/Framework/Api/Controller/SyncController.php
Shopware\Core\System\Integration\IntegrationDefinition::defineFieldssrc/Core/System/Integration/IntegrationDefinition.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/platform | composer | < 6.6.10.18 | 6.6.10.18 |
| shopware/core |
| composer |
| >= 6.7.0.0, < 6.7.10.1 |
| 6.7.10.1 |
| shopware/core | composer | < 6.6.10.18 | 6.6.10.18 |