PT-2025-15898 · Packagist · Shopware/Core+1

Published 2025-04-08 · Updated 2025-04-08

OSV

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Impact

It's possible to guess the deepLinkCode of an Document to open documents of other customers

Patches

Update to Shopware 6.6.10.3 or 6.5.8.17

Workarounds

For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

GHSA-68WV-G3FW-PQ7Q

Affected Products

Shopware/Core

Shopware/Platform

References · 6

• https://osv.dev/vulnerability/GHSA-68wv-g3fw-pq7q · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-68wv-g3fw-pq7q · Note
• https://github.com/shopware/shopware/releases/tag/v6.7.0.0-rc2 · Note
• https://github.com/shopware/shopware/releases/tag/v6.6.10.3 · Note
• https://github.com/shopware/shopware/releases/tag/v6.5.8.17 · Note