UpHeron
All vulnerabilities

Servers and applications

CVE-2024-22407

Broken Access Control order API

Severity
Medium 6.5
Published
16 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.5.7.4
Also known as
GHSA-3867-jc5c-66qf
Sources
NVD, Project advisories (GitHub)

Description

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to…

Affected software

SoftwareAffected versions
ShopwareServers and applications · cpe:a:shopware:shopware
  • Every version before 6.5.7.4
ShopwareServers and applications · github:shopware/shopware
  • Every version before 6.5.7.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-22407
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-22407
  • GitHub Advisory Database https://github.com/advisories/GHSA-3867-jc5c-66qf
  • github.com https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qf