CVE-2022-36102 Acess control list bypassed via crafted specific URLs

Medium 6.3 Published 12 Sep 2022 Updated 23 Apr 2025

Attackers can bypass access control lists in Shopware backend controllers via crafted URLs, allowing unauthorized execution of administrative actions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-36102?

CVE-2022-36102 is a medium-severity missing authorization vulnerability in Shopware Shopware, published on 12 Sep 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Shopware is an open source e-commerce software. In affected versions if backend admin controllers are called with a certain notation, the ACL could be bypassed. Users could execute actions, which they are normally not able to do. Users are advised to update to the current version (5.7.15). Users can get the update via the Auto-Updater or directly via the download overview. There are no known workarounds for this issue.

Weakness: CWE-281

Which versions are affected by CVE-2022-36102?

2 open source packages ship an affected version, including shopware/shopware. It affects 1 product.

Package	Affected	Fixed in
`shopware/shopware` Packagist	All versions	`5.7.15`
`shopware/shopware` Packagist	All versions	`5.7.15`

Products include Shopware Shopware.

How do I fix CVE-2022-36102?

Upgrade shopware/shopware to 5.7.15 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2022-36102 being exploited?

There is no known exploitation of CVE-2022-36102 in the wild and no public exploit code.

All Shopware Shopware vulnerabilities

Sources

Also known as GHSA-qc43-pgwq-3q2q.