CVE-2026-48010: Shopware privilege escalation in UserController

CVE-2026-48010 · Severity: medium · CVSS 6.5 · Published 2026-07-17

Shopware is an open-source e-commerce platform used to build and manage online stores. A security flaw in the user management system allows a staff member with limited permissions to grant themselves or others full administrator access. This could lead to an unauthorized takeover of the entire store management panel, potentially exposing customer data and business operations.

Technologies: shopware/core (Packagist), shopware/platform (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-48010 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48010 being exploited in the wild.
How severe is CVE-2026-48010?
Medium severity, with a CVSS score of 6.5, published 17 July 2026.
Which products and versions are affected?
shopware/core (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1.
Is there a fix for CVE-2026-48010?
Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48010 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48010?
Check whether you run shopware/core (Packagist) or shopware/platform (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shopware/core (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/core:^6.7.10.1
  • shopware/platform (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/platform:^6.7.10.1

Technical details

A privilege escalation vulnerability exists in Shopware's UserController::upsertUser() method. The component processes raw request data within the SYSTEM_SCOPE, which bypasses the AclWriteValidator. Unlike the IntegrationController, the UserController lacks a check to verify if the requesting user has administrative privileges before allowing the 'admin' boolean field to be set. An attacker with existing 'user:create' or 'user:update' ACL permissions can exploit this via the API to promote any account to full administrator status. The issue is resolved in versions 6.6.10.18 and 6.7.10.1 by implementing proper isAdmin() checks.

Affected products

  • Shopware shopware/core < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • Shopware shopware/platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Identifiers

  • CVE-2026-48010
  • GHSA-v39m-97p8-gqg7

Timeline

  • 2026-05-19: patched: Security releases 6.6.10.18 and 6.7.10.1 published.
  • 2026-07-17: disclosed: CVE-2026-48010 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.