CVE-2026-48008

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

• CWE-862

• https://github.com/shopware/shopware/commit/1e047f6d7fd9129271e28c1c9f1c272983c6f48f
• https://github.com/shopware/shopware/commit/db5adff33ec30b648979cd1938c87f164f7b3073
• https://github.com/shopware/shopware/releases/tag/v6.6.10.18
• https://github.com/shopware/shopware/releases/tag/v6.7.10.1
• https://github.com/shopware/shopware/security/advisories/GHSA-gv8p-48fr-4fxg

Published

Jul 17, 2026

Last Modified

Jul 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47999Adobe Commerce is affected by a stored Cross-Site Scripting …4.8
• CVE-2026-4800Impact: The fix for CVE-2021-23337 (https://github.com/advi…9.8
• CVE-2026-48000Adobe Commerce is affected by an Improper Redirect (Open Red…6.1
• CVE-2026-48001Adobe Commerce is affected by an Information Exposure vulner…3.7
• CVE-2026-48006Netty is a network application framework for development of …7.5
• CVE-2026-48007Element Call is a native Matrix video conferencing applicati…8.6
• CVE-2026-48009Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.8
• CVE-2026-4801The Page Builder Gutenberg Blocks – CoBlocks plugin for Word…6.4
• CVE-2026-48010Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48011Shopware is an open commerce platform. Prior to versions 6.6…3.7
• CVE-2026-48012Shopware is an open commerce platform. Versions 6.7.3.0 thro…4.3
• CVE-2026-48013Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.1