Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Summary
An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint.
Details
Data Exposure
Depending on the order payload configuration, attackers may retrieve:
- Customer names
- Billing address
- Shipping address
- Email addresses
- Ordered products
- Order values
- Order numbers
- Order dates
- Payment method information
- Shipping method information
- More customs, depending on the given associations in the request
Security Impact
This vulnerability allows:
- Unauthorized access to foreign customer order data
- Mass enumeration of recent orders
- Potential scraping of customer personal information
Limitation
No limitation, but only orders from the past 30 days are checked for changeable means of payment (unrelated).
Impact
The code is present since ~2021. Likely every version since then is impacted for every store.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | shopware/core | >= 6.7.0.0, < 6.7.8.1, < 6.6.10.15 | 6.7.8.1, 6.6.10.15 |
| Composer package | shopware/platform | >= 6.7.0.0, < 6.7.8.1, < 6.6.10.15 | 6.7.8.1, 6.6.10.15 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N- Weakness (CWE)
CWE-863- Platform
- Composer
- Package
shopware/core, shopware/platform- Disclosed
- 11.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7vvp-j573-5584 - CC BY 4.0
Vulnerability history: shopware/core
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 65
- First → latest
- 09.2020 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 5
- High 16
- Medium 31
- Low 13
Disclosures per year
- 2020: 7
- 2021: 13
- 2022: 7
- 2023: 6
- 2024: 7
- 2025: 12
- 2026: 13
-
Shopware: Unauthenticated data extraction possible through store-api.order endpoint this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.