https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 16:27:41 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338592 EUVD-2026-338592 https://cve.radiocsirt.org/vuln/euvd-2026-338592 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48008 <p>Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.</p> <p>Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true through the Sync API POST /api/_action/sync; the regular integration endpoint POST /api/integration blocks this, but SyncController::sync() routes writes through SyncService to EntityWriter::upsert(), and src/Core/Framework/Integration/IntegrationDefinition.php lacks WriteProtection on the admin field. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48008 https://cve.radiocsirt.org/vuln/ghsa-gv8p-48fr-4fxg <p><strong>Affected:</strong> Packagist: shopware/platform, Packagist: shopware/core</p> <p>## Summary</p> <p>A non-admin API user with `integration:create` ACL privilege can escalate to full administrator by creating an integration with `admin: true` through the Sync API (`POST /api/_action/sync`). The regular integration endpoint (`POST /api/integration`) correctly blocks this, but the Sync API bypasses the controller-level check by writing directly through the DAL EntityWriter. The `integration` entity definition lacks `WriteProtection`, and the `admin` field has no field-level restriction flag.</p> <p>**OWASP:** A01:2021 — Broken Access Control</p> <p>## Root Cause</p> <p>`IntegrationController::upsertIntegration()` checks `$source-&gt;isAdmin()` before allowing the `admin` field to be set. However, `SyncController::sync()` routes writes through `SyncService → EntityWriter`, which only applies:</p> <p>1. `AclWriteValidator` — checks entity-level ACL (`integration:create` is sufficient) 2. `EntityProtectionValidator` — checks `WriteProtection` on entity definitions, but `IntegrationDefinition` has none</p> <p>The `admin` field in `IntegrationDefinition` is a plain `BoolField` with no `WriteProtection` or special flag. The Sync API writes it without restriction.</p> <p>**Vulnerable code path:** - `src/Core/Framework/Api/Controller/SyncController.php` → `SyncService` → `EntityWriter::upsert()` - **Missing protection:** `src/Core/Framework/Integration/IntegrationDefinition.php` — `admin` field has no `WriteProtection(Context::SYSTEM_SCOPE)`</p> <p>**Working protection (bypassed):** - `src/Core/Framework/Integration…</p> <p><strong>Affected:</strong> Packagist: shopware/platform, Packagist: shopware/core</p> <p>## Summary</p> <p>A non-admin API user with `integration:create` ACL privilege can escalate to full administrator by creating an integration with `admin: true` through the Sync API (`POST /api/_action/sync`). The regular integration endpoint (`POST /api/integration`) correctly blocks this, but the Sync API bypasses the controller-level check by writing directly through the DAL EntityWriter. The `integration` entity definition lacks `WriteProtection`, and the `admin` field has no field-level restriction flag.</p> <p>**OWASP:** A01:2021 — Broken Access Control</p> <p>## Root Cause</p> <p>`IntegrationController::upsertIntegration()` checks `$source-&gt;isAdmin()` before allowing the `admin` field to be set. However, `SyncController::sync()` routes writes through `SyncService → EntityWriter`, which only applies:</p> <p>1. `AclWriteValidator` — checks entity-level ACL (`integration:create` is sufficient) 2. `EntityProtectionValidator` — checks `WriteProtection` on entity definitions, but `IntegrationDefinition` has none</p> <p>The `admin` field in `IntegrationDefinition` is a plain `BoolField` with no `WriteProtection` or special flag. The Sync API writes it without restriction.</p> <p>**Vulnerable code path:** - `src/Core/Framework/Api/Controller/SyncController.php` → `SyncService` → `EntityWriter::upsert()` - **Missing protection:** `src/Core/Framework/Integration/IntegrationDefinition.php` — `admin` field has no `WriteProtection(Context::SYSTEM_SCOPE)`</p> <p>**Working protection (bypassed):** - `src/Core/Framework/Integration…</p> https://cve.radiocsirt.org/vuln/ghsa-gv8p-48fr-4fxg