AIKIDO-2026-329179

TL;DR

SwagPayPal's /handle-payment store-api endpoint accepts a paypalOrderId value and writes it directly into the order transaction's custom fields without validating it against PayPal's API or checking that it belongs to the current transaction. Submitting the PayPal order resource ID of a different, already-paid order lets that unrelated Shopware transaction be moved to paid status, and arbitrary or non-existent IDs are passed straight through to the data abstraction layer. The PayPal order resource ID of any order is exposed via /store-api/order, so a shopper can read another order's ID and reuse it against their own transaction. The fix reserves each PayPal order ID in a dedicated database table with a unique primary key and rejects the request with a bad-request error when the ID is already tied to a different transaction.