ByteOS Network

NVD Vulnerability Details :

CVE-2026-48010

Deferred

Source-security-advisories@github.com

Published At-17 Jul, 2026 | 18:17

Updated At-17 Jul, 2026 | 18:30

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE ID	Type	Source
CWE-269	Primary	security-advisories@github.com

CWE ID: CWE-269

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d	security-advisories@github.com	N/A
https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25	security-advisories@github.com	N/A
https://github.com/shopware/shopware/releases/tag/v6.6.10.18	security-advisories@github.com	N/A
https://github.com/shopware/shopware/releases/tag/v6.7.10.1	security-advisories@github.com	N/A
https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7	security-advisories@github.com	N/A