CVE-2026-48008 Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
A non-admin API user can escalate to full administrator by creating an integration with admin privileges via the Sync API due to missing write protection.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48008?
CVE-2026-48008 is a medium-severity vulnerability in shopware platform, published on 17 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Weakness: CWE-862
Which versions are affected by CVE-2026-48008?
8 open source packages ship an affected version, including shopware/platform and shopware/core.
| Package | Affected | Fixed in |
|---|---|---|
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | All versions | 6.6.10.18 |
shopware/core Packagist | All versions | 6.6.10.18 |
2 more packages
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
How do I fix CVE-2026-48008?
Upgrade shopware/platform to a fixed version for your release line: 6.6.10.18 or 6.7.10.1.
Is CVE-2026-48008 being exploited?
There is no known exploitation of CVE-2026-48008 in the wild and no public exploit code.
Sources
Also known as GHSA-gv8p-48fr-4fxg.