Description
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying order ownership or guest-order authentication, allowing a normal customer or guest context to trigger the payment flow for another user's order while /store-api/order enforces the expected ownership model. This issue is fixed in versions 6.6.10.18 and 6.7.10.1.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
shopware shopware
< 6.6.10.18affected>= 6.7.0.0, < 6.7.10.1affected
shopware platform
< 6.6.10.18affected>= 6.7.0.0, < 6.7.10.1affected
References
- https://github.com/shopware/shopware/security/advisories/GHSA-9v5m-39wh-5chq ↗
- https://github.com/shopware/shopware/commit/69dd5b6cb01d3c2aea49ac29dd4512a87836ac3f ↗
- https://github.com/shopware/shopware/commit/df15f2e607dcf9ebc4a26ec622ffcf452dc25090 ↗
- https://github.com/shopware/shopware/releases/tag/v6.6.10.18 ↗
- https://github.com/shopware/shopware/releases/tag/v6.7.10.1 ↗