GitHub Advisoryadvisory · Packagist

GHSA-27gv-mg7w-mm34 Shopware race condition bypasses voucher restrictions

MEDIUM Published 2025-08-06 Modified 2025-11-03 Official page ↗
Aliases
CVE-2025-7954
Ecosystem
Packagist
Packages
shopware/platform
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-362
Reviewed
2025-08-06

Affected packages

• Packagist shopware/platform: <= 6.6.10.4 (no fix yet)

Description

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

Related

Alias · CVE (1)

  • CVE-2025-7954 A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass… vulnerability

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References