Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a missing authorization check in Shopware's Admin API. Specifically, the API endpoints responsible for transitioning the state of orders, order transactions, and order deliveries did not enforce any Access Control List (ACL) privileges. As a result, any authenticated user with basic API access could change the status of orders (e.g., from 'in progress' to 'shipped' or 'cancelled'), even if they did not have the order:update permission. This could lead to significant disruption of business operations, such as incorrect fulfillment, payment processing issues, and inaccurate reporting. The analysis of the patch commit 9f15faee704b61e8a96657024fa96c70b47ad082 confirms this. The patch remediates the vulnerability by adding the appropriate ACL requirements (order:update, order_transaction:update, and order_delivery:update) to the route definitions within src/Core/Checkout/Order/Api/OrderActionController.php. This ensures that only users with the correct permissions can trigger these state transitions.
Shopware\Core\Checkout\Order\Api\OrderActionController::orderStateTransitionsrc/Core/Checkout/Order/Api/OrderActionController.php
Shopware\Core\Checkout\Order\Api\OrderActionController::orderTransactionStateTransitionsrc/Core/Checkout/Order/Api/OrderActionController.php
Shopware\Core\Checkout\Order\Api\OrderActionController::orderDeliveryStateTransitionsrc/Core/Checkout/Order/Api/OrderActionController.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/platform | composer | < 6.6.10.18 | 6.6.10.18 |
| shopware/core | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/core | composer | < 6.6.10.18 | 6.6.10.18 |