https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:03:51.808841+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-48010 CVE-2026-48010 — Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts 2026-10-07T07:03:51.810023+00:00

Affected: shopware, shopware platform

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.