Privilege Escalation

shopware/platform and shopware/core are vulnerable to privilege escalation. Lack of secure handling allows the permissions set by admin-api for sales channel context to be able use within normal user sessions...

Design/Logic Flaw

Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security...