CVE-2026-48016: Shopware authorization bypass in handle-payment API

CVE-2026-48016 · Severity: medium · CVSS 4.3 · Published 2026-07-17

Shopware is an open-source e-commerce platform used to build online stores. A security flaw in the payment processing API allows a logged-in customer or guest to trigger the payment flow for an order belonging to a different user. While this does not directly expose credit card details, it allows unauthorized individuals to interfere with the checkout process and order status of other customers.

Technologies: shopware/core (Packagist), shopware/platform (Packagist), Shopware. Vendors: Packagist, Shopware.

Quick answers

Is CVE-2026-48016 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48016 being exploited in the wild.
How severe is CVE-2026-48016?
Medium severity, with a CVSS score of 4.3, published 17 July 2026.
Which products and versions are affected?
shopware/core (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; shopware/platform (Packagist) ECOSYSTEM:introduced=6.7.0.0,fixed=6.7.10.1; Shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1.
Is there a fix for CVE-2026-48016?
Yes. shopware/core (Packagist): upgrade to 6.7.10.1 or later; shopware/platform (Packagist): upgrade to 6.7.10.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48016 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-48016?
Check whether you run shopware/core (Packagist), shopware/platform (Packagist) or Shopware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shopware/core (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/core:^6.7.10.1
  • shopware/platform (Packagist): upgrade to 6.7.10.1 or later
    composer require shopware/platform:^6.7.10.1

Technical details

An authorization bypass exists in the Shopware Store API due to insufficient ownership verification. The endpoint `/store-api/handle-payment` (implemented in `HandlePaymentMethodRoute.php`) accepts a user-provided `orderId` and forwards it to the `PaymentProcessor` without verifying if the current session owner matches the order owner. An authenticated attacker or guest user can exploit this to initiate payment processes for arbitrary orders by providing the target order's ID. This bypasses the ownership model enforced by other endpoints like `/store-api/order`. The issue is resolved in versions 6.6.10.18 and 6.7.10.1 by implementing proper customer filtering on the payment route.

Affected products

  • shopware shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • shopware platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Identifiers

  • CVE-2026-48016
  • GHSA-9v5m-39wh-5chq

Timeline

  • 2026-07-17: advisory: NVD publication date
  • 2026-05-19: patched: Release of version 6.6.10.18

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.