Shopware Admin API ACL Bypass in Order State Transition (CVE-2024-48014)

Vulnerability Overview Vulnerability Name: Admin API ACL Bypass in Order State Transition Endpoints Vulnerability Description: This is a vertical authorization bypass vulnerability affecting the order state transition functionality within the Admin API. The root cause is that the transition route does not declare the required server-side ACL privileges, allowing low-privilege users to bypass authorization boundaries. As a result, authenticated users can change order states without appropriate permissions, leading to severe security impacts such as loss of operational integrity, abuse of automated workflows, and disruption of fulfillment, billing, and support processes. Scope of Impact Affected Versions: : >=6.7.0.0 =6.7.0.0 <6.7.10.1 Fixed Versions: : 6.7.10.1 : 6.6.10.18 CVSS v3 Base Metrics: Severity: Medium (6.5 / 10) Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None CVE ID: CVE-2024-48014 Remediation Expected Behavior: Order, order transaction, and order delivery transition endpoints must perform explicit server-side ACL checks. Requests should be rejected unless the caller possesses the appropriate entity update privileges. If an account receives a 403 error on the normal order update API, transition operations on the same protected resources should also be blocked by an equivalent policy. Even if the transition internally uses , the caller's authorization must be validated before entering the transition execution path. Root Cause: File: This route exposes state transitions but forwards user-controlled input ( , ) to the service layer without and without explicit privilege checks. Unauthenticated callers can directly control the transition target. File: If ACL metadata is missing for the route, ACL validation exits immediately. Consequently, these action routes completely skip authorization verification. File: The transition runs within and persists state history with the system context. This requires strict pre-authorization at the route controller boundary, but the pre-check is missing, meaning low-privilege callers still result in actual state changes. Patch Suggestions: Add explicit ACL requirements for order/order-transaction/order-delivery transition routes in , aligning them with entity update privileges. Centralize server-side privilege checks at the transition endpoints, ensuring that both the transition path and the normal update path follow a consistent authorization policy. Strictly maintain only after the authorization gate; ensure that caller privilege decisions are completed before the transition execution begins. Review APIs related to transitions to guarantee consistent enforcement of the privilege model mapping ( , , ) and ensure no unprotected routes exist.

Goal Reached Thanks to every supporter — we hit 100%!

Shopware Admin API ACL Bypass in Order State Transition (CVE-2024-48014)

More from this source