{"id":"GHSA-r2vg-hvjm-fg38","aliases":[],"url":"https://o3.security/vulnerability/GHSA-r2vg-hvjm-fg38","summary":"Shopware Customer Orders can be canceled, even if refunds are disabled","details":"Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):\nhttps://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98\nhttps://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php\n\nTo mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.","published":"2025-10-21T18:03:27Z","modified":"2026-09-10T03:50:30.221774498Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.7.3.1"},{"ecosystem":"Packagist","name":"shopware/platform","fixedVersion":"6.6.10.7"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.7.3.1"},{"ecosystem":"Packagist","name":"shopware/core","fixedVersion":"6.6.10.7"}],"fix":{"url":"https://github.com/shopware/shopware/commit/b157508aef2c820e7ff89ebd5848d3019f22b592","label":"shopware/shopware@b157508"},"references":[{"type":"WEB","url":"https://github.com/shopware/shopware/security/advisories/GHSA-r2vg-hvjm-fg38"},{"type":"WEB","url":"https://github.com/shopware/shopware/commit/b157508aef2c820e7ff89ebd5848d3019f22b592"},{"type":"PACKAGE","url":"https://github.com/shopware/shopware"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:30.221774498Z"}}