Read the docs
TI-2025-43802 Aliases GHSA-r2vg-hvjm-fg38

Shopware Customer Orders can be canceled, even if refunds are disabled

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-862.

Summary

Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php To mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.

Why it matters now

Fix Fixed shopware/platform (Packagist): 6.7.3.1, 6.6.10.7shopware/core (Packagist): 6.7.3.1, 6.6.10.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—shopware/platform (Packagist)6.7.0.0 to before 6.7.3.16.7.3.1Patch availableGHSA-r2vg-hvjm-fg38
—shopware/platform (Packagist)before 6.6.10.76.6.10.7Patch availableGHSA-r2vg-hvjm-fg38
—shopware/core (Packagist)6.7.0.0 to before 6.7.3.16.7.3.1Patch availableGHSA-r2vg-hvjm-fg38
—shopware/core (Packagist)before 6.6.10.76.6.10.7Patch availableGHSA-r2vg-hvjm-fg38
  • shopware/platform (Packagist) Vendor— Affected 6.7.0.0 to before 6.7.3.1 Fixed in 6.7.3.1 Patch available GHSA-r2vg-hvjm-fg38
  • shopware/platform (Packagist) Vendor— Affected before 6.6.10.7 Fixed in 6.6.10.7 Patch available GHSA-r2vg-hvjm-fg38
  • shopware/core (Packagist) Vendor— Affected 6.7.0.0 to before 6.7.3.1 Fixed in 6.7.3.1 Patch available GHSA-r2vg-hvjm-fg38
  • shopware/core (Packagist) Vendor— Affected before 6.6.10.7 Fixed in 6.6.10.7 Patch available GHSA-r2vg-hvjm-fg38

Remediation

  • Fix · GHSA-r2vg-hvjm-fg38 shopware/platform (Packagist) Fixed in 6.7.3.1 Advisory →
  • Fix · GHSA-r2vg-hvjm-fg38 shopware/platform (Packagist) Fixed in 6.6.10.7 Advisory →
  • Fix · GHSA-r2vg-hvjm-fg38 shopware/core (Packagist) Fixed in 6.7.3.1 Advisory →
  • Fix · GHSA-r2vg-hvjm-fg38 shopware/core (Packagist) Fixed in 6.6.10.7 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-r2vg-hvjm-fg38

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences