CyberRota Analysis
AI-GeneratedThe Store API endpoint in Shopware versions prior to 6.6.10.18 and 6.7.10.1 is vulnerable to unauthorized payment processing, as it allows users to manipulate the orderId without proper verification of ownership or authentication. This could enable a normal customer or guest to initiate payment for another user's order, leading to potential financial fraud. Organizations using affected versions of Shopware should prioritize updating to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.