CVE-2026-48014 Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Low-privileged users can bypass ACL checks to modify order, transaction, and delivery states in Shopware.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48014?
CVE-2026-48014 is a medium-severity missing authorization vulnerability in shopware platform, published on 17 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare PlatformRequest::ATTRIBUTE_ACL or perform an explicit privilege check, so AclAnnotationValidator exits when route ACL metadata is absent and low-privileged users without order:update, order_transaction:update, or order_delivery:update can trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Weakness: CWE-862
Which versions are affected by CVE-2026-48014?
8 open source packages ship an affected version, including shopware/platform and shopware/core.
| Package | Affected | Fixed in |
|---|---|---|
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | All versions | 6.6.10.18 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/platform Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | All versions | 6.6.10.18 |
shopware/core Packagist | All versions | 6.6.10.18 |
2 more packages
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
shopware/core Packagist | From 6.7.0.0 | 6.7.10.1 |
How do I fix CVE-2026-48014?
Upgrade shopware/platform to a fixed version for your release line: 6.6.10.18 or 6.7.10.1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-48014 being exploited?
There is no known exploitation of CVE-2026-48014 in the wild and no public exploit code.
Sources
Also known as GHSA-f8q6-3g5w-jjr6.