CVE-2022-24872

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.

• CWE-732
• CWE-732

• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022Patch, Vendor Advisory
• https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77cPatch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8cccThird Party Advisory
• https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2022Patch, Vendor Advisory
• https://github.com/shopware/platform/commit/083765e2d64a00315050c4891800c9e98ba0c77cPatch, Third Party Advisory
• https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8cccThird Party Advisory

Published

Apr 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24867GLPI is a Free Asset and IT Management Software package, tha…7.5
• CVE-2022-24868GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24869GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-2487A vulnerability has been found in WAVLINK WN535K2 and WN535K…9.8
• CVE-2022-24870Combodo iTop is a web based IT Service Management tool. In 3…5.4
• CVE-2022-24871Shopware is an open commerce platform based on Symfony Frame…5.5
• CVE-2022-24873Shopware is an open source e-commerce software platform. Pri…6.1
• CVE-2022-24874Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-24875The CVEProject/cve-services is an open source project used t…7.5
• CVE-2022-24876GLPI is a Free Asset and IT Management Software package, tha…5.4
• CVE-2022-24877Flux is an open and extensible continuous delivery solution …8.8
• CVE-2022-24878Flux is an open and extensible continuous delivery solution …6.5