PT-2025-45765 · Packagist · Shopware/Core+1

Publicado 2025-10-21 · Atualizado 2025-10-21

OSV

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php

To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

GHSA-R2VG-HVJM-FG38

Produtos afetados

Shopware/Core

Shopware/Platform

Referências · 4

• https://github.com/shopware/shopware · Nota
• https://github.com/shopware/shopware/security/advisories/GHSA-r2vg-hvjm-fg38 · Nota
• https://github.com/shopware/shopware/commit/b157508aef2c820e7ff89ebd5848d3019f22b592 · Nota
• https://osv.dev/vulnerability/GHSA-r2vg-hvjm-fg38 · Aviso do Fabricante