AIKIDO-2026-289523
shopware/core is vulnerable to Privilege Escalation
65
Medium Risk
This Affects:
shopware/coreTL;DR
Shopware's Administration user-update path still allowed mass assignment of nested aclRoles after CVE-2026-48010 blocked the admin flag. An authenticated Administration user with permission to update users can attach extra ACL roles through that write and gain privileges beyond those originally granted, including administrative capabilities. The patch validates nested ACL role writes so generic Admin API writes cannot create or update acl_role entities outside authorized controllers.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and Administration users have permission to update other users.
Background info
shopware/core is vulnerable to Privilege Escalation in versions 6.7.0.0 - 6.7.13.0 and 6.0.0.0 - 6.6.10.22.
How to fix this
Upgrade the shopware/core and/or the shopware/platform library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant