CVE-2026-48014: Shopware Privilege Escalation Vulnerability

CVE-2026-48014 Overview

CVE-2026-48014 is a missing authorization vulnerability [CWE-862] in Shopware, an open commerce platform. The flaw exists in the order state transition API endpoints defined in src/Core/Checkout/Order/Api/OrderActionController.php. These routes do not declare PlatformRequest::ATTRIBUTE_ACL and perform no explicit privilege check. As a result, the AclAnnotationValidator exits when route ACL metadata is absent. Low-privileged authenticated users without order:update, order_transaction:update, or order_delivery:update permissions can trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. The issue affects Shopware versions prior to 6.6.10.18 and 6.7.10.1.

Critical Impact
Authenticated low-privileged users can alter order, transaction, and delivery states, bypassing intended access controls and compromising order integrity.

Affected Products

Shopware versions prior to 6.6.10.18
Shopware versions prior to 6.7.10.1
OrderActionController order, transaction, and delivery state transition routes

Discovery Timeline

2026-07-17 - CVE-2026-48014 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-48014

Vulnerability Analysis

The vulnerability resides in Shopware's order action controller, which exposes routes such as /api/_action/order/{orderId}/state/{transition} along with related transaction and delivery transition endpoints. These routes are intended to be gated by Access Control List (ACL) permissions such as order:update, order_transaction:update, and order_delivery:update. However, the affected route definitions omit the PlatformRequest::ATTRIBUTE_ACL default. Shopware's AclAnnotationValidator treats missing ACL metadata as a signal to exit rather than deny access. Authenticated API users therefore reach the controller regardless of their assigned permissions.

Once inside the controller, the code invokes StateMachineRegistry::transition() using Context::createDefaultContext(), which elevates the write to SYSTEM_SCOPE. This bypasses entity-level permission enforcement that would otherwise reject the writes.

Root Cause

The root cause is a broken access control [CWE-862] pattern. Route metadata authoritative for ACL enforcement was never registered on the state transition endpoints. Combined with a permissive validator that fails open when annotations are absent, this produces authorization bypass on any endpoint that forgets the ACL default.

Attack Vector

Exploitation requires an authenticated API session with any low-privileged role. The attacker issues a POST request to the vulnerable transition route with a target orderId and transition name. The server accepts the call and performs the state machine write, changing an order to states such as paid, cancelled, shipped, or refunded without holding the corresponding update permissions.

php

// Patch applied in OrderActionController.php
#[Route(
    path: '/api/_action/order/{orderId}/state/{transition}',
    name: 'api.action.order.state_machine.order.transition_state',
    defaults: [PlatformRequest::ATTRIBUTE_ACL => ['order:update']],
    methods: [Request::METHOD_POST]
)]
public function orderStateTransition(
    string $orderId,
    string $transition,
// Source: https://github.com/shopware/shopware/commit/86dff24ba500e16325742e59d20357f57a79c2af

The patch adds the missing PlatformRequest::ATTRIBUTE_ACL => ['order:update'] default, forcing AclAnnotationValidator to enforce the order:update privilege before the controller runs.

Detection Methods for CVE-2026-48014

Indicators of Compromise

Unexpected POST requests to /api/_action/order/{orderId}/state/{transition}, /api/_action/order_transaction/{transactionId}/state/{transition}, or /api/_action/order_delivery/{deliveryId}/state/{transition} from API users whose roles do not include order update privileges.
Order, transaction, or delivery state changes with no corresponding action log entry from an administrator or storefront workflow.
Sudden bursts of state transitions such as paid, refund, cancel, or ship initiated by a single API integration key.

Detection Strategies

Correlate Shopware API access logs with the user role catalog to flag state transition calls made by users lacking order:update, order_transaction:update, or order_delivery:update privileges.
Query the state_machine_history table for transitions attributed to SYSTEM_SCOPE writes originating from non-administrative user contexts.
Alert on HTTP 200 responses to /api/_action/order/*/state/* where the requesting integration or user is scoped to read-only or catalog-only roles.

Monitoring Recommendations

Ingest Shopware application logs and web server access logs into a centralized log platform and build detections around the order transition endpoints.
Monitor for anomalous order lifecycle changes such as unpaid orders being marked paid or shipped without matching payment or shipping provider callbacks.
Review API integration tokens periodically and restrict scopes to the minimum required for each downstream system.

How to Mitigate CVE-2026-48014

Immediate Actions Required

Upgrade Shopware to version 6.6.10.18 on the 6.6 branch or 6.7.10.1 on the 6.7 branch as documented in the GitHub Security Advisory GHSA-f8q6-3g5w-jjr6.
Audit existing API user roles and integration tokens, revoking any tokens that do not require order management access.
Review state_machine_history records for suspicious transitions since the vulnerable code path was introduced.

Patch Information

Shopware fixed the issue in versions 6.6.10.18 and 6.7.10.1 by adding PlatformRequest::ATTRIBUTE_ACL defaults to the affected routes. See the fix commits 86dff24 and 9f15fae, and the release notes for v6.6.10.18 and v6.7.10.1.

Workarounds

Where immediate upgrade is not possible, restrict access to the /api/_action/order/*/state/*, /api/_action/order_transaction/*/state/*, and /api/_action/order_delivery/*/state/* routes at the reverse proxy or web application firewall (WAF) layer to trusted administrative sources.
Reduce the number of API users with any authenticated role until the patch is deployed, since exploitation requires an authenticated session.

bash

# Example nginx restriction for order state transition routes
location ~ ^/api/_action/(order|order_transaction|order_delivery)/[^/]+/state/ {
    allow 10.0.0.0/8;      # admin network
    deny all;
    proxy_pass http://shopware_backend;
}