PT-2025-45765 · Packagist · Shopware/Core+1

Published 2025-10-21 · Updated 2025-10-21

OSV

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php

To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

GHSA-R2VG-HVJM-FG38

Affected Products

Shopware/Core

Shopware/Platform

References · 4

• https://osv.dev/vulnerability/GHSA-r2vg-hvjm-fg38 · Vendor Advisory
• https://github.com/shopware/shopware · Note
• https://github.com/shopware/shopware/security/advisories/GHSA-r2vg-hvjm-fg38 · Note
• https://github.com/shopware/shopware/commit/b157508aef2c820e7ff89ebd5848d3019f22b592 · Note