CVE-2026-48009

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account by triggering POST /api/_action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PATCH /api/_action/user/user-recovery/password; the root cause is that src/Core/System/User/Recovery/UserRecoveryDefinition.php exposes the hash field through the Admin API without ApiAware(false) or ReadProtection. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

• CWE-200

• https://github.com/shopware/shopware/commit/06f8b9aa4fecb239a2ff33a6546192d7ce7ed0f8
• https://github.com/shopware/shopware/commit/9ef4873f810e26fb38da051624f7f2720139279a
• https://github.com/shopware/shopware/commit/d82c23d8d5b22dd722c8f76c4f66785d1a7a72d8
• https://github.com/shopware/shopware/releases/tag/v6.6.10.18
• https://github.com/shopware/shopware/releases/tag/v6.7.10.1
• https://github.com/shopware/shopware/security/advisories/GHSA-8v9p-g828-v98f

Published

Jul 17, 2026

Last Modified

Jul 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4800Impact: The fix for CVE-2021-23337 (https://github.com/advi…9.8
• CVE-2026-48000Adobe Commerce is affected by an Improper Redirect (Open Red…6.1
• CVE-2026-48001Adobe Commerce is affected by an Information Exposure vulner…3.7
• CVE-2026-48006Netty is a network application framework for development of …7.5
• CVE-2026-48007Element Call is a native Matrix video conferencing applicati…8.6
• CVE-2026-48008Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-4801The Page Builder Gutenberg Blocks – CoBlocks plugin for Word…6.4
• CVE-2026-48010Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48011Shopware is an open commerce platform. Prior to versions 6.6…3.7
• CVE-2026-48012Shopware is an open commerce platform. Versions 6.7.3.0 thro…4.3
• CVE-2026-48013Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.1
• CVE-2026-48014Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5