Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| shopware/platform | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/platform | composer | < 6.6.10.18 | 6.6.10.18 |
| shopware/core | composer | >= 6.7.0.0, < 6.7.10.1 | 6.7.10.1 |
| shopware/core | composer | < 6.6.10.18 | 6.6.10.18 |
Miggo AIRoot Cause AnalysisThe vulnerability is an object-level authorization flaw in the Shopware Store API. The /store-api/handle-payment endpoint allowed a low-privileged user to initiate a payment for an order they did not own. The root cause was twofold. First, the API route itself, handled by Shopware\Core\Checkout\Payment\SalesChannel\HandlePaymentMethodRoute::load, did not enforce any authentication, allowing any user to access it. Second, the underlying data access logic in Shopware\Core\Checkout\Payment\PaymentProcessor::getCurrentOrderTransaction fetched order details using only the orderId provided by the user, without verifying that the order belonged to the user making the request. An attacker who obtained a valid orderId could therefore trigger the payment process for a foreign order. The patch addresses both issues by adding authentication to the API route and by adding a customer ownership check to the database query that retrieves the order transaction.
Shopware\Core\Checkout\Payment\SalesChannel\HandlePaymentMethodRoute::loadsrc/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php
Shopware\Core\Checkout\Payment\PaymentProcessor::paysrc/Core/Checkout/Payment/PaymentProcessor.php
Shopware\Core\Checkout\Payment\PaymentProcessor::getCurrentOrderTransactionsrc/Core/Checkout/Payment/PaymentProcessor.php