[MEDIUM] Shopware: Stored XSS via SVG file upload — no SVG sanitization

PKSA-qf56-zbmm-29m8 CVE-2026-48015 GHSA-xvhc-gm7j-mhmc

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment

PKSA-y5sy-w7mt-r97k CVE-2026-48016 GHSA-9v5m-39wh-5chq

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Admin API ACL Bypass in Order State Transition Endpoints

PKSA-rnpb-7fbj-phyz CVE-2026-48014 GHSA-f8q6-3g5w-jjr6

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[LOW] Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames

PKSA-yt77-qm1k-2vvb CVE-2026-48011 GHSA-7w52-7jvm-m9vw

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

PKSA-fstf-sh35-tmx7 CVE-2026-48010 GHSA-v39m-97p8-gqg7

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Admin Account Takeover via User Recovery Hash Exposure

PKSA-946b-qy3w-67d7 CVE-2026-48009 GHSA-8v9p-g828-v98f

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[MEDIUM] Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass

PKSA-zymb-qg2c-csgb CVE-2026-48008 GHSA-gv8p-48fr-4fxg

Affected version: <6.6.10.18|>=6.7.0.0,<6.7.10.1

Reported by:
GitHub

[HIGH] Shopware vulnerable to a potential take over of app credentials

PKSA-fyfg-936j-xtjc CVE-2026-31889 GHSA-c4p7-rwrg-pf6p

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[MEDIUM] Shopware has user enumeration via distinct error codes on Store API login endpoint

PKSA-cck7-yytv-pqc6 CVE-2026-31888 GHSA-gqc5-xv7m-gcjq

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[HIGH] Shopware: Unauthenticated data extraction possible through store-api.order endpoint

PKSA-1d39-xhww-sgwf CVE-2026-31887 GHSA-7vvp-j573-5584

Affected version: <6.6.10.15|>=6.7.0.0,<6.7.8.1

Reported by:
GitHub

[MEDIUM] Shopware 6's password recovery link does not expire after email change

PKSA-w3qy-s9h7-2hqr GHSA-2w46-vq8h-98vh

Affected version: >=6.7.0.0,<6.7.4.1|<6.6.10.9

Reported by:
GitHub

[MEDIUM] Shopware Customer Orders can be canceled, even if refunds are disabled

PKSA-v415-g75g-bqsy GHSA-r2vg-hvjm-fg38

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[MEDIUM] Shopware exposes sensitive user information via CSV export mapping

PKSA-kypv-cx5n-qkc8 GHSA-27c9-vp3w-6ww8

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[LOW] Shopware vulnerable to Server-Side Request Forgery (SSRF) – order invoice

PKSA-h5dj-jyqc-4fjr GHSA-3cpp-fv95-mpr5

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[LOW] Shopware vulnerable to path traversal via Plugin upload

PKSA-6wp3-462p-vyty GHSA-6wh5-mw9h-5c3w

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[MEDIUM] Shopware vulnerable to MediaVisibilityRestrictionSubscriber bypass when reading media entities by aggregating fields individually

PKSA-b824-t6kf-bqqz GHSA-m895-2hj3-8cg9

Affected version: <6.6.10.7|>=6.7.0.0,<6.7.3.1

Reported by:
GitHub

[LOW] Shopware default newsletter opt-in settings allow for mass sign-up abuse

PKSA-8vfm-96b7-t9nt CVE-2025-32378 GHSA-4h9w-7vfp-px8m

Affected version: <6.5.8.17|>=6.7.0.0-rc1,<6.7.0.0-rc2|>=6.6.0.0-rc1,<6.6.10.3

Reported by:
GitHub

[MEDIUM] Shopware Broken ACL on Document retrieval to access other customers documents

PKSA-frt7-rv6d-9v53 GHSA-68wv-g3fw-pq7q

Affected version: <6.5.8.17|>=6.7.0.0-rc1,<6.7.0.0-rc2|>=6.6.0.0,<6.6.10.3

Reported by:
GitHub

[HIGH] Shopware Vulnerable to Blind SQL-injection in DAL aggregations

PKSA-m54b-2v2z-x1bs CVE-2025-27892 GHSA-8g35-7rmw-7f59

Affected version: <6.5.8.18|>=6.6.0.0,<=6.6.10.2|=6.7.0.0-rc1

Reported by:
GitHub

[HIGH] Shopware allows Denial Of Service via password length

PKSA-k472-zz4q-rd5r CVE-2025-30151 GHSA-cgfj-hj93-rmh2

Affected version: <6.5.8.17|>=6.7.0.0-rc1,<6.7.0.0-rc2|>=6.6.0.0,<6.6.10.3

Reported by:
GitHub

[MEDIUM] Shopware 6 allows attackers to check for registered accounts through the store-api

PKSA-dbxn-psgm-2qmr CVE-2025-30150 GHSA-hh7j-6x3q-f52h

Affected version: <=6.5.8.17|>=6.6.0.0,<=6.6.10.2|=6.7.0.0-rc1

Reported by:
GitHub

[MEDIUM] Shopware vulnerable to blind SQL-injection in DAL aggregations

PKSA-wp2c-7yp8-5fvs CVE-2024-42357 GHSA-p6w9-r443-r752

Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12

Reported by:
GitHub

[HIGH] Shopware vulnerable to Server Side Template Injection in Twig using Context functions

PKSA-kt1g-n1g2-hzb4 CVE-2024-42356 GHSA-35jp-8cgg-p4wj

Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12

Reported by:
GitHub

[HIGH] Shopware vulnerable to Server Side Template Injection in Twig using deprecation silence tag

PKSA-6stq-czfs-1nvv CVE-2024-42355 GHSA-27wp-jvhw-v4xp

Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12

Reported by:
GitHub

[MEDIUM] Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

PKSA-4spx-rq41-wk8h CVE-2024-42354 GHSA-hhcq-ph6w-494g

Affected version: >=6.6.0.0,<=6.6.5.0|<=6.5.8.12

Reported by:
GitHub

[MEDIUM] Shopware Improper Session Handling in store-api account logout

PKSA-s8vz-878v-gv1c CVE-2024-31447 GHSA-5297-wrrp-rcj7

Affected version: >=6.6.0.0-rc1,<6.6.1.0|>=6.3.5.0,<6.5.8.8

Reported by:
GitHub

[MEDIUM] Broken Access Control order API in Shopware

PKSA-mm7q-gnjj-tttn CVE-2024-22407 GHSA-3867-jc5c-66qf

Affected version: <=6.5.7.3

Reported by:
GitHub

[CRITICAL] Blind SQL injection in shopware

PKSA-ktmn-6519-qrdp CVE-2024-22406 GHSA-qmp9-2xwj-m6m9

Affected version: <=6.5.7.3

Reported by:
GitHub