CVE-2026-48010: Shopware Privilege Escalation: Non-admin User With Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v39m-97p8-gqg7",
  "modified" : "2026-06-04T19:28:29Z",
  "published" : "2026-06-04T19:28:29Z",
  "aliases" : [ "CVE-2026-48010" ],
  "summary" : "Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts",
  "details" : "`UserController::upsertUser()` writes user data in `SYSTEM_SCOPE` and does not filter the `admin` field. A non-admin API user with `user:create` or `user:update` ACL permission can set `admin: true` on new or existing users, escalating to full admin access.\n\n## The Problem\n\nIn `src/Core/Framework/Api/Controller/UserController.php`, line 210-234:\n\n```php\npublic function upsertUser(?string $userId, Request $request, Context $context, ResponseFactoryInterface $factory): Response\n{\n    $data = $request->request->all(); // raw request data, no field filtering\n    // ...\n    $events = $context->scope(Context::SYSTEM_SCOPE, fn (Context $context) =>\n        $this->userRepository->upsert([$data], $context)\n    );\n}\n```\n\n`SYSTEM_SCOPE` bypasses `AclWriteValidator` entirely (line 52 of `AclWriteValidator::preValidate()` returns early for `SYSTEM_SCOPE`). The `admin` boolean field is accepted without restriction.\n\nCompare with `IntegrationController::upsertIntegration()` in the same codebase, which correctly checks:\n\n```php\nif ((!$source instanceof AdminApiSource)\n    || (!$source->isAdmin()\n    && isset($data['admin']))\n) {\n    throw new PermissionDeniedException();\n}\n```\n\n`UserController` is missing this exact check.\n\n## Impact\n\nAny API user with the low-privilege `user:create` permission can create accounts with full admin access, or with `user:update` can promote any existing user to admin. This is a direct privilege escalation.\n\n## Suggested Fix\n\nAdd the same `isAdmin()` check from `IntegrationController`:\n\n```php\n$source = $context->getSource();\nif ((!$source instanceof AdminApiSource) || (!$source->isAdmin() && isset($data['admin']))) {\n    throw new PermissionDeniedException();\n}\n```\n\nBest regards,\nKeyvan Hardani",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/platform"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.7.0.0"
      }, {
        "fixed" : "6.7.10.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/platform"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.6.10.18"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.7.0.0"
      }, {
        "fixed" : "6.7.10.1"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopware/core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "6.6.10.18"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/shopware/shopware"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/shopware/shopware/releases/tag/v6.6.10.18"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/shopware/shopware/releases/tag/v6.7.10.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-04T19:28:29Z",
    "nvd_published_at" : null
  }
}