CVE-2026-48016: Shopware Auth Bypass Vulnerability

CVE-2026-48016 Overview

CVE-2026-48016 is a missing authorization vulnerability [CWE-639] in Shopware, an open commerce platform. The flaw affects the /store-api/handle-payment Store API endpoint implemented in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php. The endpoint accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication. As a result, a normal customer or guest context can trigger the payment flow for another user's order, while the parallel /store-api/order endpoint enforces the expected ownership model. The issue is fixed in versions 6.6.10.18 and 6.7.10.1.

Critical Impact
Authenticated customers or guest sessions can initiate the payment flow on orders belonging to other users, breaking the tenant isolation model expected across the Store API.

Affected Products

Shopware versions prior to 6.6.10.18
Shopware versions prior to 6.7.10.1
Shopware Store API /store-api/handle-payment endpoint

Discovery Timeline

2026-07-17 - CVE-2026-48016 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-48016

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in Shopware's Store API. The HandlePaymentMethodRoute::load() handler reads the orderId from request query and body parameters and passes it directly to the PaymentProcessor. Neither component confirms that the authenticated customer or the guest session owns the referenced order. Any authenticated customer, and in some contexts a guest, can invoke the payment flow against arbitrary orders. Related endpoints such as /store-api/order correctly scope order lookups by customer identity, which highlights the inconsistency the patch resolves.

Root Cause

The root cause is missing authorization on a state-changing Store API route. The route definition did not require login, did not restrict guests appropriately, and the downstream PaymentProcessor did not filter order lookups by the acting customer. This is a classic authorization by user-controlled key issue tracked as [CWE-639].

Attack Vector

An attacker with a low-privileged customer or guest session sends a GET or POST request to /store-api/handle-payment supplying the target orderId. Because the handler trusts the supplied identifier without ownership validation, the payment routine executes against the victim's order. Exploitation requires network access to the Store API and knowledge or enumeration of a valid order identifier.

php

// Patch: src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php
// Route now requires login and only optionally allows guest sessions

-    #[Route(path: '/store-api/handle-payment', name: 'store-api.payment.handle', methods: ['GET', 'POST'])]
+    #[Route(
+        path: '/store-api/handle-payment',
+        name: 'store-api.payment.handle',
+        defaults: [
+            PlatformRequest::ATTRIBUTE_LOGIN_REQUIRED => true,
+            PlatformRequest::ATTRIBUTE_LOGIN_REQUIRED_ALLOW_GUEST => true,
+        ],
+        methods: ['GET', 'POST']
+    )]
     public function load(Request $request, SalesChannelContext $context): HandlePaymentMethodRouteResponse
     {
         $data = [...$request->query->all(), ...$request->request->all()];

Source: Shopware commit 69dd5b6 and commit df15f2e. The companion patch to PaymentProcessor.php adds OrderException handling and filters order lookups by the current customer.

Detection Methods for CVE-2026-48016

Indicators of Compromise

Store API access logs showing POST or GET requests to /store-api/handle-payment with orderId values that do not belong to the authenticated sw-context-token customer.
Payment transactions transitioning state on orders while the request customer identifier differs from the order's orderCustomer.customerId.
Repeated /store-api/handle-payment requests iterating through sequential or brute-forced orderId values from a single session or IP.

Detection Strategies

Correlate Shopware application logs with web server logs to identify /store-api/handle-payment calls where the requested orderId mismatches the session's customer.
Alert on anomalous ratios of handle-payment invocations to prior /store-api/order interactions from the same session, since legitimate flows normally precede payment with an order lookup.
Review order_transaction state history for transitions initiated by sessions that never touched the parent order via other Store API routes.

Monitoring Recommendations

Enable verbose Store API request logging on all Shopware storefront edges and forward events to a centralized data lake for retention and query.
Track baseline call volume to /store-api/handle-payment per customer and per IP, then alert on deviations.
Monitor guest checkout flows for reuse of sw-context-token values across unrelated orderId references.

How to Mitigate CVE-2026-48016

Immediate Actions Required

Upgrade Shopware to 6.6.10.18 or 6.7.10.1 immediately on all storefronts running affected versions.
Audit recent order_transaction state changes and Store API access logs for suspicious /store-api/handle-payment activity.
Rotate any payment-provider tokens or webhook secrets that may have been influenced by unauthorized payment initiation.

Patch Information

Shopware released fixes in v6.6.10.18 and v6.7.10.1. Details are documented in GitHub Security Advisory GHSA-9v5m-39wh-5chq. The patch requires authentication on the route via ATTRIBUTE_LOGIN_REQUIRED with optional guest access, and filters order lookups in PaymentProcessor by the current customer.

Workarounds

If immediate upgrade is not possible, restrict access to /store-api/handle-payment at the reverse proxy or WAF layer to authenticated sessions only.
Deploy WAF rules that inspect requests to /store-api/handle-payment and drop those where the supplied orderId cannot be correlated to the session's customer context.
Temporarily disable guest checkout on affected storefronts until the patched version is deployed.

bash

# Composer upgrade example for Shopware 6.7.x branch
composer require shopware/core:6.7.10.1 shopware/storefront:6.7.10.1 shopware/administration:6.7.10.1 --update-with-dependencies
bin/console cache:clear
bin/console database:migrate --all