{"id":"CVE-2026-48010","aliases":["GHSA-v39m-97p8-gqg7"],"url":"https://o3.security/vulnerability/CVE-2026-48010","summary":"Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts","details":"`UserController::upsertUser()` writes user data in `SYSTEM_SCOPE` and does not filter the `admin` field. A non-admin API user with `user:create` or `user:update` ACL permission can set `admin: true` on new or existing users, escalating to full admin access.\n\n## The Problem\n\nIn `src/Core/Framework/Api/Controller/UserController.php`, line 210-234:\n\n```php\npublic function upsertUser(?string $userId, Request $request, Context $context, ResponseFactoryInterface $factory): Response\n{\n    $data = $request->request->all(); // raw request data, no field filtering\n    // ...\n    $events = $context->scope(Context::SYSTEM_SCOPE, fn (Context $context) =>\n        $this->userRepository->upsert([$data], $context)\n    );\n}\n```\n\n`SYSTEM_SCOPE` bypasses `AclWriteValidator` entirely (line 52 of `AclWriteValidator::preValidate()` returns early for `SYSTEM_SCOPE`). The `admin` boolean field is accepted without restriction.\n\nCompare with `IntegrationController::upsertIntegration()` in the same codebase, which correctly checks:\n\n```php\nif ((!$source instanceof AdminApiSource)\n    || (!$source->isAdmin()\n    && isset($data['admin']))\n) {\n    throw new PermissionDeniedException();\n}\n```\n\n`UserController` is missing this exact check.\n\n## Impact\n\nAny API user with the low-privilege `user:create` permission can create accounts with full admin access, or with `user:update` can promote any existing user to admin. This is a direct privilege escalation.\n\n## Suggested Fix\n\nAdd the same `isAdmin()` check from `IntegrationController`:\n\n```php\n$source = $context->getSource();\nif ((!$source instanceof AdminApiSource) || (!$source->isAdmin() && isset($data['admin']))) {\n    throw new PermissionDeniedException();\n}\n```\n\nBest regards,\nKeyvan Hardani","published":"2026-07-17T17:55:25.722Z","modified":"2026-08-12T03:51:37.255198697Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"},"epss":{"score":0.00472,"percentile":0.39801,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.7.10.1"},{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.6.10.18"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.7.10.1"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.6.10.18"}],"fix":{"url":"https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d","label":"shopware/shopware@7f1cef3"},"references":[{"type":"WEB","url":"https://github.com/shopware/shopware/releases/tag/v6.6.10.18"},{"type":"WEB","url":"https://github.com/shopware/shopware/releases/tag/v6.7.10.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48010.json"},{"type":"ADVISORY","url":"https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48010"},{"type":"FIX","url":"https://github.com/shopware/shopware/commit/7f1cef324ca4edfa6369264cc1c41287d032624d"},{"type":"FIX","url":"https://github.com/shopware/shopware/commit/d8d9a34a9255abf69c2798015a17cd6a80b08c25"},{"type":"PACKAGE","url":"https://github.com/shopware/shopware"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.255198697Z"}}