Shopware prior 6.6.10.18/6.7.10.1 Sync API IntegrationDefinition.php SyncController::sync admin improper synchronization

Summaryinfo

A vulnerability was found in Shopware. It has been classified as critical. Affected is the function SyncController::sync of the file src/Core/Framework/Integration/IntegrationDefinition.php of the component Sync API. The manipulation of the argument admin leads to improper synchronization. This vulnerability is referenced as CVE-2026-48008. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Shopware and classified as critical. This issue affects the function SyncController::sync of the file src/Core/Framework/Integration/IntegrationDefinition.php of the component Sync API. The manipulation of the argument admin with an unknown input leads to a improper synchronization vulnerability. Using CWE to declare the problem leads to CWE-662. The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-48008 since 05/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit.

By approaching the search of inurl:src/Core/Framework/Integration/IntegrationDefinition.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 6.6.10.18 or 6.7.10.1 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Shopware

License

• commercial

Website

• Product: https://github.com/shopware/shopware/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion