https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T08:05:33.147372+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-339046 EUVD-2026-339046 2026-10-07T08:05:33.149547+00:00 EUVD-2026-339046 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48016 fkie_cve-2026-48016 2026-10-07T08:05:33.149576+00:00

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.

 https://cve.radiocsirt.org/vuln/ghsa-9v5m-39wh-5chq GHSA-9v5m-39wh-5chq — Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment 2026-10-07T08:05:33.149610+00:00

Affected: Packagist: shopware/platform, Packagist: shopware/core

## Summary

The Shopware Store API endpoint `/store-api/handle-payment` contains an object-level authorization flaw that allows a low-privileged external user with a normal customer or guest context to trigger the payment flow for another user’s order by supplying a foreign `orderId`. The affected functionality is the Store API payment initiation and retry flow. The root cause is that the endpoint forwards the user-controlled `orderId` into the payment processing logic without verifying that the caller owns the referenced order or has passed the required guest-order authentication. As a result, payment attempts for foreign orders are accepted by the server, which can compromise the integrity of order and payment workflows.

## Description

Shopware exposes `/store-api/handle-payment` to initiate or retry the payment flow for an already created order. Under the normal order access model, customers should only be able to view or act on their own orders, and guest users should only be able to access guest orders after completing additional verification such as `deepLinkCode`, email address, and postal code. The Store API `/store-api/order` route follows this model: authenticated customers only see their own orders, and guest users are denied access unless guest-order authentication is performed. However, `/store-api/handle-payment` does not follow the same protection model. It only checks whether the supplied `orderId` exists and then directly forwards it into the payment proce…