Shopware: Admin Account Takeover via User Recovery Hash Exposure
Priority LOW 30CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/user-recovery/password; the root cause is that src/Core/System/User/Recovery/UserRecoveryDefinition.php exposes the hash field through the Admin API without ApiAware(false) or ReadProtection. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00457 39th percentileScored 2026-11-07
Fix Fixed shopware (shopware): 6.6.10.18, 6.7.10.1platform (shopware): 6.6.10.18, 6.7.10.1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| shopware | shopware | before 6.6.10.18; 6.7.0.0 to before 6.7.10.1 | 6.6.10.18, 6.7.10.1 | Patch available | CNA |
| shopware | platform | before 6.6.10.18; 6.7.0.0 to before 6.7.10.1 | 6.6.10.18, 6.7.10.1 | Patch available | CNA |
| — | shopware/platform (Packagist) | 6.7.0.0 to before 6.7.10.1 | 6.7.10.1 | Patch available | GHSA-8v9p-g828-v98f |
| — | shopware/platform (Packagist) | before 6.6.10.18 | 6.6.10.18 | Patch available | GHSA-8v9p-g828-v98f |
| — | shopware/core (Packagist) | 6.7.0.0 to before 6.7.10.1 | 6.7.10.1 | Patch available | GHSA-8v9p-g828-v98f |
| — | shopware/core (Packagist) | before 6.6.10.18 | 6.6.10.18 | Patch available | GHSA-8v9p-g828-v98f |
- shopware Vendorshopware Affected before 6.6.10.18; 6.7.0.0 to before 6.7.10.1 Fixed in 6.6.10.18, 6.7.10.1 Patch available CNA
- platform Vendorshopware Affected before 6.6.10.18; 6.7.0.0 to before 6.7.10.1 Fixed in 6.6.10.18, 6.7.10.1 Patch available CNA
- shopware/platform (Packagist) Vendor— Affected 6.7.0.0 to before 6.7.10.1 Fixed in 6.7.10.1 Patch available GHSA-8v9p-g828-v98f
- shopware/platform (Packagist) Vendor— Affected before 6.6.10.18 Fixed in 6.6.10.18 Patch available GHSA-8v9p-g828-v98f
- shopware/core (Packagist) Vendor— Affected 6.7.0.0 to before 6.7.10.1 Fixed in 6.7.10.1 Patch available GHSA-8v9p-g828-v98f
- shopware/core (Packagist) Vendor— Affected before 6.6.10.18 Fixed in 6.6.10.18 Patch available GHSA-8v9p-g828-v98f
Remediation
- Fix · CNA shopware (shopware) Fixed in 6.6.10.18, 6.7.10.1
- Fix · CNA platform (shopware) Fixed in 6.6.10.18, 6.7.10.1
- Fix · GHSA-8v9p-g828-v98f shopware/platform (Packagist) Fixed in 6.7.10.1 Advisory →
- Fix · GHSA-8v9p-g828-v98f shopware/platform (Packagist) Fixed in 6.6.10.18 Advisory →
- Fix · GHSA-8v9p-g828-v98f shopware/core (Packagist) Fixed in 6.7.10.1 Advisory →
- Fix · GHSA-8v9p-g828-v98f shopware/core (Packagist) Fixed in 6.6.10.18 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48009
- 2026-10-03 Alias added: GHSA-8v9p-g828-v98f
References
Other 7
- https://github.com/shopware/shopware/security/advisories/GHSA-8v9p-g828-v98f
- https://github.com/shopware/shopware/commit/06f8b9aa4fecb239a2ff33a6546192d7ce7ed0f8
- https://github.com/shopware/shopware/commit/9ef4873f810e26fb38da051624f7f2720139279a
- https://github.com/shopware/shopware/commit/d82c23d8d5b22dd722c8f76c4f66785d1a7a72d8
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1
- https://github.com/shopware/shopware
More shopware vulnerabilities
- TI-2023-01895 Improper Control of Generation of Code in Twig Rendered Views in Shopware CVSS 3.1HIGH 8.8
- TI-2025-20623 Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the… CVSS 3.1MEDIUM 6.8
- TI-2024-28343 Shopware vulnerable to Server Side Template Injection in Twig using Context functions CVSS 3.1HIGH 8.3
- TI-2019-09582 In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can… CVSS 3.1HIGH 8.8
- TI-2016-02607 The backend/Login/load/ script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code. CVSS 3.0CRITICAL 9.8
- TI-2025-32365 A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-48009 · CVE Program
- CVE-2026-48009 · NVD
- FIRST EPSS
- GHSA-8v9p-g828-v98f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences