AIKIDO-2026-329179
swag/paypal is vulnerable to Insecure Direct Object Reference (IDOR)
53
Medium Risk
This Affects:
swag/paypalTL;DR
SwagPayPal's /handle-payment store-api endpoint accepts a paypalOrderId value and writes it directly into the order transaction's custom fields without validating it against PayPal's API or checking that it belongs to the current transaction. Submitting the PayPal order resource ID of a different, already-paid order lets that unrelated Shopware transaction be moved to paid status, and arbitrary or non-existent IDs are passed straight through to the data abstraction layer. The PayPal order resource ID of any order is exposed via /store-api/order, so a shopper can read another order's ID and reuse it against their own transaction. The fix reserves each PayPal order ID in a dedicated database table with a unique primary key and rejects the request with a bad-request error when the ID is already tied to a different transaction.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
swag/paypal is vulnerable to Insecure Direct Object Reference (IDOR) in versions 0.0.1 - 8.12.0, 0.0.1 - 9.13.0 and 0.0.1 - 10.8.0.
How to fix this
Upgrade the swag/paypal and/or the store.shopware.com/swagpaypal library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.