PT-2026-46885 · Shopware+2 · Xplatform+3
CVE-2026-48009
·
Published
2026-06-04
·
Updated
2026-07-17
CVSS v3.1
6.8
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Shopware versions prior to 6.6.10.18
Shopware versions prior to 6.7.10.1
Description
A low-privilege admin user with
user recovery:read Access Control List (ACL) permissions can take over any admin account. The issue occurs because the hash field in src/Core/System/User/Recovery/UserRecoveryDefinition.php is exposed through the Admin API without ApiAware(false) or ReadProtection. An attacker can exploit this by triggering a recovery request via the POST /api/ action/user/user-recovery endpoint, retrieving the secret recovery hash through the POST /api/search/user-recovery endpoint, and finally resetting the victim's password using the PATCH /api/ action/user/user-recovery/password endpoint.Recommendations
Update to version 6.6.10.18.
Update to version 6.7.10.1.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Xplatform
Shopware
Shopware/Core
Shopware/Platform