CVE-2026-48010 Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
A non-admin user with create permissions can escalate privileges to admin by setting the admin flag during user creation due to missing validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48010?
CVE-2026-48010 is a medium-severity vulnerability in shopware platform, published on 17 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Weakness: CWE-269
Which versions are affected by CVE-2026-48010?
8 open source packages ship an affected version, including shopware/platform and shopware/core.
| Package | Affected | Fixed in |
|---|---|---|
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | All versions | 6.6.10.18 |
shopware/core Packagist | All versions | 6.6.10.18 |
2 more packages
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
How do I fix CVE-2026-48010?
Upgrade shopware/platform to a fixed version for your release line: 6.6.10.18 or 6.7.10.1.
Is CVE-2026-48010 being exploited?
There is no known exploitation of CVE-2026-48010 in the wild and no public exploit code.
Sources
Also known as GHSA-v39m-97p8-gqg7.