CVE-2026-48009

MEDIUM

Shopware: Admin Account Takeover via User Recovery Hash Exposure

Title source: cna
STIX 2.1

Description

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/user-recovery/password; the root cause is that src/Core/System/User/Recovery/UserRecoveryDefinition.php exposes the hash field through the Admin API without ApiAware(false) or ReadProtection. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

References (6)

Core 6

Scores

CVSS v3 6.8
EPSS 0.0027
EPSS Percentile 19.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (4)
shopware/platform < 6.6.10.18
shopware/platform >= 6.7.0.0, < 6.7.10.1
shopware/shopware < 6.6.10.18
shopware/shopware >= 6.7.0.0, < 6.7.10.1
Published Jul 17, 2026
Tracked Since Jul 18, 2026