CyberRota Analysis
AI-GeneratedA non-admin API user in Shopware versions prior to 6.6.10.18 and 6.7.10.1 can exploit a vulnerability to escalate their privileges to full administrator by creating an integration with admin rights via the Sync API. This flaw arises from insufficient write protection on the admin field in the IntegrationDefinition component. Organizations using affected versions should prioritize updating to the patched releases to mitigate the risk of unauthorized administrative access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.