CVE-2022-24872— Improper Access Control in shopware
Quick assessment
Affected
shopware platform
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Shopware是德国Shopware公司的一套开源电子商务软件。 Shopware 存在安全漏洞，该漏洞源于 admin-api 对 sales channel 的权限设置在正常用户会话中仍然可用。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-24872
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Access Control in shopware
Source: CVE Program / CVE List V5
Vulnerability Description
Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5
Vulnerability Title
Shopware 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Shopware是德国Shopware公司的一套开源电子商务软件。 Shopware 存在安全漏洞，该漏洞源于 admin-api 对 sales channel 的权限设置在正常用户会话中仍然可用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-24872
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24872
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-24872 (1)
Vendor Advisories for CVE-2022-24872 (1)
-
https://github.com/shopware/platform/security/advisories/GHSA-9wrv-g75h-8ccc x_refsource_CONFIRM
Other References for CVE-2022-24872 (1)
IV. Related Vulnerabilities
Same product: platform
-
CVE-2026-97228
Rapid7 Bulk Export MCP — GraphQL Query Injection in Export S -
CVE-2026-91079
Huly Platform through 0.7.426 SSRF via Print Service -
CVE-2026-81846
runZero MCP 'Findings summaries' Data Leak -
CVE-2026-56769
Huly Platform - Server-Side Request Forgery via /import Endp -
CVE-2026-7778
runZero Platform dashboard configuration exposure
Same vendor: shopware
-
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect -
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP V -
CVE-2026-48009
Shopware: Admin Account Takeover via User Recovery Hash Expo -
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition End -
CVE-2026-48010
Shopware: Privilege escalation: non-admin user with user:cre
Same weakness: CWE-732
-
CVE-2026-47518
NVIDIA驱动安全微控制器越权致提权漏洞 -
CVE-2026-94204
Incorrect Permission Assignment for Critical Resource in Vii -
CVE-2026-84414
IBM i is Affected By An Incorrect Permission Assignment Vuln -
CVE-2026-73598
Dell SCG Policy Manager <5.34.00.16 提权漏洞 -
CVE-2026-15952
Improper Permission Assignment in Scheduler Service
V. Comments for CVE-2022-24872
No comments yet