https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:21:50.893571+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338592 EUVD-2026-338592 2026-10-07T07:21:50.927737+00:00 EUVD-2026-338592 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48008 fkie_cve-2026-48008 2026-10-07T07:21:50.927776+00:00

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

 https://cve.radiocsirt.org/vuln/ghsa-gv8p-48fr-4fxg GHSA-gv8p-48fr-4fxg — Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass 2026-10-07T07:21:50.927810+00:00

Affected: Packagist: shopware/platform, Packagist: shopware/core

## Summary

A non-admin API user with `integration:create` ACL privilege can escalate to full administrator by creating an integration with `admin: true` through the Sync API (`POST /api/_action/sync`). The regular integration endpoint (`POST /api/integration`) correctly blocks this, but the Sync API bypasses the controller-level check by writing directly through the DAL EntityWriter. The `integration` entity definition lacks `WriteProtection`, and the `admin` field has no field-level restriction flag.

**OWASP:** A01:2021 — Broken Access Control

## Root Cause

`IntegrationController::upsertIntegration()` checks `$source->isAdmin()` before allowing the `admin` field to be set. However, `SyncController::sync()` routes writes through `SyncService → EntityWriter`, which only applies:

1. `AclWriteValidator` — checks entity-level ACL (`integration:create` is sufficient) 2. `EntityProtectionValidator` — checks `WriteProtection` on entity definitions, but `IntegrationDefinition` has none

The `admin` field in `IntegrationDefinition` is a plain `BoolField` with no `WriteProtection` or special flag. The Sync API writes it without restriction.

**Vulnerable code path:** - `src/Core/Framework/Api/Controller/SyncController.php` → `SyncService` → `EntityWriter::upsert()` - **Missing protection:** `src/Core/Framework/Integration/IntegrationDefinition.php` — `admin` field has no `WriteProtection(Context::SYSTEM_SCOPE)`

**Working protection (bypassed):** - `src/Core/Framework/Integration…