Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/platform | composer | < 6.6.10.18 | 6.6.10.18 |
| shopware/core | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/core | composer | < 6.6.10.18 | 6.6.10.18 |
Miggo AIRoot Cause AnalysisThe vulnerability allows a low-privileged admin user to take over any other admin account. The root cause is an information disclosure vulnerability where the password recovery hash, which is supposed to be secret, is exposed via the Admin API. The vulnerability description clearly identifies the file src/Core/System/User/Recovery/UserRecoveryDefinition.php and the hash field as the source of the problem. The defineFields method in this file is responsible for defining the properties of the user_recovery entity, including its API visibility. The patch for this vulnerability involves adding the ApiAware(false) flag to the hash field within this method, which prevents it from being exposed through the API. Therefore, the defineFields method is the precise location of the vulnerable code. During an attack, an attacker would make a request to the /api/search/user-recovery endpoint, which would then use the flawed entity definition to serialize and return the sensitive hash field.
Shopware\Core\System\User\Recovery\UserRecoveryDefinition::defineFieldssrc/Core/System/User/Recovery/UserRecoveryDefinition.php