[MEDIUM] Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

PKSA-yg4m-g48j-bdvp CVE-2026-48013 GHSA-gq96-5pfx-f4vc

Affected version: >=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Stored XSS via SVG file upload — no SVG sanitization

PKSA-xngt-2zh8-qhq6 CVE-2026-48015 GHSA-xvhc-gm7j-mhmc

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

PKSA-6c8x-wdsy-zx17 CVE-2026-48016 GHSA-9v5m-39wh-5chq

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Admin API ACL Bypass in Order State Transition Endpoints

PKSA-1xdm-446c-t7rz CVE-2026-48014 GHSA-f8q6-3g5w-jjr6

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[LOW] Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

PKSA-xwkj-rryn-xz6v CVE-2026-48011 GHSA-7w52-7jvm-m9vw

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

PKSA-xbrd-fvys-3t24 CVE-2026-48010 GHSA-v39m-97p8-gqg7

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Admin Account Takeover via User Recovery Hash Exposure

PKSA-tk1x-h875-8y1s CVE-2026-48009 GHSA-8v9p-g828-v98f

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

PKSA-b8bq-4ngt-d89p CVE-2026-48008 GHSA-gv8p-48fr-4fxg

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[HIGH] Shopware vulnerable to a potential take over of app credentials

PKSA-qj2q-c8sp-3qyg CVE-2026-31889 GHSA-c4p7-rwrg-pf6p

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[MEDIUM] Shopware has user enumeration via distinct error codes on Store API login endpoint

PKSA-8zg6-v85t-wcz3 CVE-2026-31888 GHSA-gqc5-xv7m-gcjq

Affected version: <6.6.10.14|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[HIGH] Shopware: Unauthenticated data extraction possible through store-api.order endpoint

PKSA-bwqq-zb6b-g5dh CVE-2026-31887 GHSA-7vvp-j573-5584

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[MEDIUM] Shopware Customer Orders can be canceled, even if refunds are disabled

PKSA-g23j-x3sb-wcbc GHSA-r2vg-hvjm-fg38

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[MEDIUM] Shopware exposes sensitive user information via CSV export mapping

PKSA-cb17-wqsx-y85w GHSA-27c9-vp3w-6ww8

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[LOW] Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

PKSA-ph5g-5w5h-nqtz GHSA-3cpp-fv95-mpr5

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[LOW] Shopware vulnerable to path traversal via Plugin upload

PKSA-wg2b-w14d-z55p GHSA-6wh5-mw9h-5c3w

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[MEDIUM] Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

PKSA-h7xc-cnc9-hq4s GHSA-m895-2hj3-8cg9

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub