Executive brief
Shopware is an open-source e-commerce platform used to build online stores. A security flaw in the payment processing API allows a logged-in customer or guest to trigger the payment flow for an order belonging to a different user. While this does not directly expose credit card details, it allows unauthorized individuals to interfere with the checkout process and order status of other customers.
Technical details
An authorization bypass exists in the Shopware Store API due to insufficient ownership verification. The endpoint `/store-api/handle-payment` (implemented in `HandlePaymentMethodRoute.php`) accepts a user-provided `orderId` and forwards it to the `PaymentProcessor` without verifying if the current session owner matches the order owner. An authenticated attacker or guest user can exploit this to initiate payment processes for arbitrary orders by providing the target order's ID. This bypasses the ownership model enforced by other endpoints like `/store-api/order`. The issue is resolved in versions 6.6.10.18 and 6.7.10.1 by implementing proper customer filtering on the payment route.
Affected products
- shopware shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
- shopware platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
Timeline
- 2026-07-17: advisory: NVD publication date
- 2026-05-19: patched: Release of version 6.6.10.18
References
- https://github.com/shopware/shopware/commit/69dd5b6cb01d3c2aea49ac29dd4512a87836ac3f
- https://github.com/shopware/shopware/commit/df15f2e607dcf9ebc4a26ec622ffcf452dc25090
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1
- https://github.com/shopware/shopware/security/advisories/GHSA-9v5m-39wh-5chq