GitHub Advisoryadvisory · Packagist

GHSA-68wv-g3fw-pq7q Shopware Broken ACL on Document retrieval to access other customers documents

MEDIUM Published 2025-04-08 Modified 2025-04-08 Official page ↗
Ecosystem
Packagist
Packages
shopware/core, shopware/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2025-04-08

Affected packages

• Packagist shopware/core: >= 6.6.0.0, < 6.6.10.3 → fixed in 6.6.10.3 • Packagist shopware/platform: >= 6.6.0.0, < 6.6.10.3 → fixed in 6.6.10.3 • Packagist shopware/core: >= 6.7.0.0-rc1, < 6.7.0.0-rc2 → fixed in 6.7.0.0-rc2 • Packagist shopware/platform: >= 6.7.0.0-rc1, < 6.7.0.0-rc2 → fixed in 6.7.0.0-rc2 • Packagist shopware/core: < 6.5.8.17 → fixed in 6.5.8.17 • Packagist shopware/platform: < 6.5.8.17 → fixed in 6.5.8.17

Description

Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers Patches Update to Shopware 6.6.10.3 or 6.5.8.17 Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References