CVE-2026-48010: Shopware Auth Bypass Vulnerability

CVE-2026-48010 Overview

CVE-2026-48010 is a privilege escalation vulnerability [CWE-269] in Shopware, an open commerce platform. The flaw resides in UserController::upsertUser() within src/Core/Framework/Api/Controller/UserController.php. This method writes raw user data in SYSTEM_SCOPE without filtering the admin field. A non-admin API user holding user:create or user:update ACL permissions can set admin: true on new or existing user accounts. The sibling method IntegrationController::upsertIntegration() contained an isAdmin() guard for the same field, but UserController did not. Shopware fixed the issue in versions 6.6.10.18 and 6.7.10.1.

Critical Impact
Authenticated non-admin API users with limited ACL permissions can elevate themselves or others to full administrator privileges, gaining complete control over the Shopware instance.

Affected Products

Shopware versions prior to 6.6.10.18 (6.6.x branch)
Shopware versions prior to 6.7.10.1 (6.7.x branch)
Shopware Admin API UserController endpoint

Discovery Timeline

2026-07-17 - CVE-2026-48010 published to NVD
2026-07-18 - Last updated in NVD database

Technical Details for CVE-2026-48010

Vulnerability Analysis

The vulnerability is a broken access control flaw in the Shopware Admin API. The upsertUser() method processes incoming JSON payloads and persists user records using SYSTEM_SCOPE, which bypasses standard write-scope checks. The controller verified that the caller had user:update permission or was updating their own account, but did not enforce a separate check for changes to the sensitive admin boolean field.

As a result, any API caller who could reach upsertUser() was able to include admin: true in the request body. The persistence layer accepted this field verbatim because SYSTEM_SCOPE skipped ACL enforcement on individual attributes. An analogous integration endpoint, IntegrationController::upsertIntegration(), already contained the required isAdmin() check, exposing the inconsistency.

Root Cause

The root cause is a missing authorization check on a privileged field. The controller conflated two authorization decisions: whether the caller can modify the user object at all, and whether the caller can modify the admin attribute specifically. Writing data in SYSTEM_SCOPE further removed field-level ACL enforcement that would otherwise intercept the change.

Attack Vector

An attacker needs a valid Admin API session with user:create or user:update ACL privileges. The attacker submits a request to the user upsert endpoint containing admin: true. The updated account then possesses full administrator rights across the Shopware instance, including access to customer data, orders, and system configuration.

php

// Security patch: src/Core/Framework/Api/Controller/UserController.php
// Source: https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25

        }
        $data['id'] = $userId ?: $data['id'];

-        if (
-            !$source->isAllowed('user:update')
-            && $source->getUserId() !== $data['id']
-        ) {
+        $isSelfUpdate = $source->getUserId() === $data['id'];
+        $canUpdateUsers = $source->isAllowed('user:update');
+
+        if (!$canUpdateUsers && !$isSelfUpdate) {
+            throw new PermissionDeniedException();
+        }
+
+        $isTryingToChangeAdmin = isset($data['admin']);
+
+        if (!$source->isAdmin() && $isTryingToChangeAdmin) {
             throw new PermissionDeniedException();
         }

The patch adds an explicit isAdmin() check that throws PermissionDeniedException whenever a non-admin caller includes the admin field in the payload. A second commit (7f1cef324ca4edfa6369264cc1c41287d032624d) applies the same guard to a related code path.

Detection Methods for CVE-2026-48010

Indicators of Compromise

Admin API requests to /api/user or /api/_action/user/* containing an admin field with a boolean value in the JSON body.
User accounts whose admin flag transitioned from false to true without a corresponding change by an existing administrator.
New user records created by non-admin API integrations that immediately possess administrator privileges.

Detection Strategies

Audit the Shopware user table for accounts flagged as admin and cross-reference against expected administrator rosters.
Enable and review Shopware Admin API access logs for POST and PATCH calls to user endpoints originating from integration users or restricted ACL roles.
Search web server or reverse proxy logs for request bodies containing the string "admin":true sent to user upsert routes.

Monitoring Recommendations

Alert on any change to the admin column of the user table, especially outside of maintenance windows.
Monitor creation of new administrator-scoped API access keys or integrations following user upsert activity.
Review authentication events for newly elevated accounts logging into the Admin UI or issuing high-privilege API calls.

How to Mitigate CVE-2026-48010

Immediate Actions Required

Upgrade Shopware installations on the 6.6.x branch to version 6.6.10.18.
Upgrade Shopware installations on the 6.7.x branch to version 6.7.10.1.
Review all user accounts and revoke administrator status from any that should not hold it.
Rotate API keys and integration credentials that had user:create or user:update ACL permissions.

Patch Information

Shopware released fixes in v6.6.10.18 and v6.7.10.1. The remediation is described in GitHub Security Advisory GHSA-v39m-97p8-gqg7 and implemented across two commits: d8d9a34a and 7f1cef32. Both add an isAdmin() check that rejects requests attempting to modify the admin field from non-admin callers.

Workarounds

Restrict the user:create and user:update ACL privileges to trusted administrators only until patching completes.
Disable or scope down integration accounts that expose user management endpoints to external systems.
Place the Shopware Admin API behind network controls that limit which clients can reach /api/user routes.

bash

# Verify installed Shopware version and upgrade via Composer
php bin/console --version
composer require shopware/core:~6.7.10.1 shopware/administration:~6.7.10.1 \
  shopware/storefront:~6.7.10.1 shopware/elasticsearch:~6.7.10.1 --no-scripts
php bin/console system:update:finish