CVE-2026-48010

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

• CWE-269

• https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d
• https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25
• https://github.com/shopware/shopware/releases/tag/v6.6.10.18
• https://github.com/shopware/shopware/releases/tag/v6.7.10.1
• https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7

Published

Jul 17, 2026

Last Modified

Jul 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48001Adobe Commerce is affected by an Information Exposure vulner…3.7
• CVE-2026-48006Netty is a network application framework for development of …7.5
• CVE-2026-48007Element Call is a native Matrix video conferencing applicati…8.6
• CVE-2026-48008Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48009Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.8
• CVE-2026-4801The Page Builder Gutenberg Blocks – CoBlocks plugin for Word…6.4
• CVE-2026-48011Shopware is an open commerce platform. Prior to versions 6.6…3.7
• CVE-2026-48012Shopware is an open commerce platform. Versions 6.7.3.0 thro…4.3
• CVE-2026-48013Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.1
• CVE-2026-48014Shopware is an open commerce platform. Prior to 6.6.10.18 an…6.5
• CVE-2026-48015Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.9
• CVE-2026-48016Shopware is an open commerce platform. Prior to 6.6.10.18 an…4.3