Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability exists in the UserController::upsertUser method within src/Core/Framework/Api/Controller/UserController.php. The method uses Context::SYSTEM_SCOPE, which intentionally bypasses standard ACL permission checks. The flaw was the absence of a specific check to validate who is allowed to set the admin flag on a user account. As a result, any API user with the relatively low-level user:create or user:update permissions could create a new user with admin privileges or grant admin rights to an existing user by simply including "admin": true in the request body. This provides a direct path to privilege escalation. The patch, identified in commit 7f1cef324ca4edfa6369264cc1c41287d032624d, rectifies this by adding a condition that throws a PermissionDeniedException if a non-admin user attempts to set the admin field. Therefore, the function Shopware\Core\Framework\Api\Controller\UserController::upsertUser is the exact location of the vulnerability and would appear in any runtime trace of an exploit.
Shopware\Core\Framework\Api\Controller\UserController::upsertUsersrc/Core/Framework/Api/Controller/UserController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/platform | composer | < 6.6.10.18 | 6.6.10.18 |
| shopware/core | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/core | composer | < 6.6.10.18 | 6.6.10.18 |