Junglewise Threat Intelligence

CVE-2026-48009: Shopware admin account takeover via recovery hash exposure

CVE-2026-48009 · Severity: medium · CVSS 6.8 · Published 2026-07-17

Technologies: Shopware. Vendors: Shopware.

Executive brief

Shopware is an open-source e-commerce platform used to power online stores. A security vulnerability allows a staff member with limited administrative permissions to take full control of any other administrator account, including those with higher privileges. By exploiting this flaw, an attacker can bypass the intended security of the password reset process to gain unauthorized access to the entire store management system, potentially leading to data theft or service disruption.

Technical details

An information exposure vulnerability (CWE-200) exists in Shopware's Admin API due to the 'hash' field in the UserRecoveryDefinition being exposed without proper read protection. An attacker with 'user_recovery:read' ACL permissions can trigger a password recovery for any administrator via the unauthenticated 'POST /api/_action/user/user-recovery' endpoint. They can then retrieve the secret recovery hash by querying 'POST /api/search/user-recovery' and complete the account takeover using 'PATCH /api/_action/user/user-recovery/password'. The fix involves removing the ApiAware flag and adding access checks to the UserRecoveryEntity hash property.

Affected products

  • Shopware shopware/core < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Timeline

  • 2026-05-19: patched: Fixed in versions 6.6.10.18 and 6.7.10.1
  • 2026-05-19: advisory: GHSA-8v9p-g828-v98f published
  • 2026-07-17: disclosed: CVE-2026-48009 published to NVD

References

Related threats