Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, UserController::upsertUser() in src/Core/Framework/Api/Controller/UserController.php writes raw user data in SYSTEM_SCOPE without filtering the admin field, so a non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users; IntegrationController::upsertIntegration() contains an isAdmin() check for the same field, but UserController was missing this check. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
shopware shopware
< 6.6.10.18affected>= 6.7.0.0, < 6.7.10.1affected
shopware platform
< 6.6.10.18affected>= 6.7.0.0, < 6.7.10.1affected
References
- https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7 ↗
- https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d ↗
- https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25 ↗
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18 ↗
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1 ↗