5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2w46-vq8h-98vh

GHSA-2w46-vq8h-98vh: Shopware 6's password recovery link does not expire after email change

Summary

When a customer changes their email address after requesting a password reset, the old password reset link (tied to the previous email) remains valid. An attacker with access to the old email inbox is potentially able to reset the customer’s password even after the user changes their email address.

PoC

Log in to a Shopware account.
Request a password reset for your current email address.
Copy the password reset link but do not open it.
Log back into your account.n
Navigate to Account Settings → Email and change your email address.
Use the previously copied reset link (from before the email change).
The system allows password change using the old link.

Impact

Reproduced on Stable 6.6.10.7 and trunk.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-2w46-vq8h-98vh

GHSA-2w46-vq8h-98vh:

5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
shopware/core	composer	< 6.6.10.9	6.6.10.9
shopware/core	composer	>= 6.7.0.0, < 6.7.4.1	6.7.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability allows an attacker to use an old password recovery link even after a user has changed their email address. The root cause is the system's failure to invalidate password recovery tokens upon an email change. The analysis of the provided patches pinpoints the exact location of this flaw. The commits 1338dd9a11e361639704bf8f09b6878552eb8c13 and 2fb94855696a90045b81c503d216ba7df8e64e52 modify the ChangeEmailRoute.php file. Specifically, the change method within the Shopware\Core\Checkout\Customer\SalesChannel\ChangeEmailRoute class is updated. The patch introduces new logic that, after successfully changing the customer's email, searches for and deletes any existing password recovery records for that customer. This action effectively invalidates any previously issued password reset links. Therefore, the change method in its pre-patched state is the vulnerable function, as it directly handles the email change process without performing the necessary security measure of expiring recovery tokens.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

5

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2w46-vq8h-98vh: Shopware 6's password recovery link does not expire after email change

Summary

PoC

Impact

GHSA-2w46-vq8h-98vh:

5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

5

5

GHSA-2w46-vq8h-98vh: Shopware 6's password recovery link does not expire after email change

Summary

PoC

Impact

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI