Junglewise Threat Intelligence

CVE-2026-48016: Shopware authorization bypass in handle-payment API

CVE-2026-48016 · Severity: medium · CVSS 4.3 · Published 2026-07-17

Technologies: Shopware. Vendors: Shopware.

Executive brief

Shopware is an open-source e-commerce platform used to build online stores. A security flaw in the payment processing API allows a logged-in customer or guest to trigger the payment flow for an order belonging to a different user. While this does not directly expose credit card details, it allows unauthorized individuals to interfere with the checkout process and order status of other customers.

Technical details

An authorization bypass exists in the Shopware Store API due to insufficient ownership verification. The endpoint `/store-api/handle-payment` (implemented in `HandlePaymentMethodRoute.php`) accepts a user-provided `orderId` and forwards it to the `PaymentProcessor` without verifying if the current session owner matches the order owner. An authenticated attacker or guest user can exploit this to initiate payment processes for arbitrary orders by providing the target order's ID. This bypasses the ownership model enforced by other endpoints like `/store-api/order`. The issue is resolved in versions 6.6.10.18 and 6.7.10.1 by implementing proper customer filtering on the payment route.

Affected products

  • shopware shopware < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1
  • shopware platform < 6.6.10.18, >= 6.7.0.0, < 6.7.10.1

Timeline

  • 2026-07-17: advisory: NVD publication date
  • 2026-05-19: patched: Release of version 6.6.10.18

References

Related threats