# CVE-2026-48009: Shopware admin account takeover via recovery hash exposure

Source: https://junglewise.ai/threats/cve-2026-48009-shopware-admin-account-takeover-via-recovery-hash-exposure  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-48009 · Severity: medium · CVSS 6.8 · Published 2026-07-17

Shopware is an open-source e-commerce platform used to power online stores. A security vulnerability allows a staff member with limited administrative permissions to take full control of any other administrator account, including those with higher privileges. By exploiting this flaw, an attacker can bypass the intended security of the password reset process to gain unauthorized access to the entire store management system, potentially leading to data theft or service disruption.

Technologies: [shopware/core (Packagist)](https://junglewise.ai/threats/technologies/shopware-core), [shopware/platform (Packagist)](https://junglewise.ai/threats/technologies/shopware-platform), [Shopware](https://junglewise.ai/threats/technologies/shopware). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Shopware](https://junglewise.ai/threats/vendors/shopware).

## Quick answers

**Is CVE-2026-48009 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48009 being exploited in the wild.

**How severe is CVE-2026-48009?** Medium severity, with a CVSS score of 6.8, published 17 July 2026.

**Which products and versions are affected?** shopware/core (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; Shopware >= 6.7.0.0, < 6.7.10.1; < 6.6.10.18.

**Is there a fix for CVE-2026-48009?** Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48009 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-48009?** Check whether you run shopware/core (Packagist), shopware/platform (Packagist) or Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shopware/core (Packagist): upgrade to 6.7.10.1 or later

  ```sh
  composer require shopware/core:^6.7.10.1
  ```

- shopware/platform (Packagist): upgrade to 6.7.10.1 or later

  ```sh
  composer require shopware/platform:^6.7.10.1
  ```


## Technical details

An information exposure vulnerability (CWE-200) exists in Shopware's Admin API due to the 'hash' field in the UserRecoveryDefinition being exposed without proper read protection. An attacker with 'user_recovery:read' ACL permissions can trigger a password recovery for any administrator via the unauthenticated 'POST /api/_action/user/user-recovery' endpoint. They can then retrieve the secret recovery hash by querying 'POST /api/search/user-recovery' and complete the account takeover using 'PATCH /api/_action/user/user-recovery/password'. The fix involves removing the ApiAware flag and adding access checks to the UserRecoveryEntity hash property.

## Affected products

- Shopware shopware/core < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
- Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

## Identifiers

- CVE-2026-48009
- GHSA-8v9p-g828-v98f

## Timeline

- 2026-05-19: patched: Fixed in versions 6.6.10.18 and 6.7.10.1
- 2026-05-19: advisory: GHSA-8v9p-g828-v98f published
- 2026-07-17: disclosed: CVE-2026-48009 published to NVD

## References

- [https://github.com/shopware/shopware/commit/06f8b9aa4fecb239a2ff33a6546192d7ce7ed0f8](https://github.com/shopware/shopware/commit/06f8b9aa4fecb239a2ff33a6546192d7ce7ed0f8)
- [https://github.com/shopware/shopware/commit/9ef4873f810e26fb38da051624f7f2720139279a](https://github.com/shopware/shopware/commit/9ef4873f810e26fb38da051624f7f2720139279a)
- [https://github.com/shopware/shopware/commit/d82c23d8d5b22dd722c8f76c4f66785d1a7a72d8](https://github.com/shopware/shopware/commit/d82c23d8d5b22dd722c8f76c4f66785d1a7a72d8)
- [https://github.com/shopware/shopware/releases/tag/v6.6.10.18](https://github.com/shopware/shopware/releases/tag/v6.6.10.18)
- [https://github.com/shopware/shopware/releases/tag/v6.7.10.1](https://github.com/shopware/shopware/releases/tag/v6.7.10.1)
- [https://github.com/shopware/shopware/security/advisories/GHSA-8v9p-g828-v98f](https://github.com/shopware/shopware/security/advisories/GHSA-8v9p-g828-v98f)

## Related threats

- [Shopware stored XSS in media upload via missing security headers](https://junglewise.ai/threats/cve-2026-104937-shopware-version-6-7-allows-the-upload-of-attacker-controlled)
- [Shopware SSRF in Media External-Link endpoint](https://junglewise.ai/threats/cve-2026-48013-shopware-ssrf-in-media-external-link-endpoint)
- [Shopware open redirect in SSO entry point via Referer header](https://junglewise.ai/threats/cve-2026-48012-shopware-open-redirect-in-sso-entry-point-via-referer-header)
- [Shopware authorization bypass in handle-payment API](https://junglewise.ai/threats/cve-2026-48016-shopware-authorization-bypass-in-handle-payment-api)
- [Shopware stored XSS via unsanitized SVG file upload](https://junglewise.ai/threats/cve-2026-48015-shopware-stored-xss-via-unsanitized-svg-file-upload)