CVE-2026-48009: Shopware admin account takeover via recovery hash exposure

CVE-2026-48009 · Severity: medium · CVSS 6.8 · Published 2026-07-17

Shopware is an open-source e-commerce platform used to power online stores. A security vulnerability allows a staff member with limited administrative permissions to take full control of any other administrator account, including those with higher privileges. By exploiting this flaw, an attacker can bypass the intended security of the password reset process to gain unauthorized access to the entire store management system, potentially leading to data theft or service disruption.

Technologies: shopware/core (Packagist), shopware/platform (Packagist), Shopware. Vendors: Packagist, Shopware.

Quick answers

Is CVE-2026-48009 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48009 being exploited in the wild.
How severe is CVE-2026-48009?
Medium severity, with a CVSS score of 6.8, published 17 July 2026.
Which products and versions are affected?
shopware/core (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; Shopware >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18.
Is there a fix for CVE-2026-48009?
Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48009 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48009?
Check whether you run shopware/core (Packagist), shopware/platform (Packagist) or Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shopware/core (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/core:^6.7.10.1
  • shopware/platform (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/platform:^6.7.10.1

Technical details

An information exposure vulnerability (CWE-200) exists in Shopware's Admin API due to the 'hash' field in the UserRecoveryDefinition being exposed without proper read protection. An attacker with 'user_recovery:read' ACL permissions can trigger a password recovery for any administrator via the unauthenticated 'POST /api/_action/user/user-recovery' endpoint. They can then retrieve the secret recovery hash by querying 'POST /api/search/user-recovery' and complete the account takeover using 'PATCH /api/_action/user/user-recovery/password'. The fix involves removing the ApiAware flag and adding access checks to the UserRecoveryEntity hash property.

Affected products

  • Shopware shopware/core < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Identifiers

  • CVE-2026-48009
  • GHSA-8v9p-g828-v98f

Timeline

  • 2026-05-19: patched: Fixed in versions 6.6.10.18 and 6.7.10.1
  • 2026-05-19: advisory: GHSA-8v9p-g828-v98f published
  • 2026-07-17: disclosed: CVE-2026-48009 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.