Shopware fixes Store API vulnerability allowing administrator takeover

Shopware merchants should update to 6.7.13.1 or 6.6.10.23 immediately. Sansec discovered and confirmed the vulnerability in Shopware 6.7.12.2, the latest stable release at the time of testing.

An attacker can exploit the flaw to take over an administrator account and execute PHP on the Shopware server. The attack needs an active Sales Channel key. Headless storefronts expose this key to clients as part of normal operation.

Affected versions

Shopware rates the vulnerability High (CVSS 8.6): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Shopware advisories:

• GHSA-p37c-pm9p-7vm5

What merchants should do now

1. Update Shopware to one of the fixed releases listed above or restrict access to the Store API where feasible.
2. Run eComscan to check for vulnerable Shopware code, malicious plugins and modified PHP files.
3. After updating, review password recovery activity, remove suspicious administrator accounts, reset passwords and revoke unknown OAuth tokens.
4. Review all installed plugins and the Shopware filesystem for code that your team did not deploy.

Scaling vulnerability research

This finding is part of a broader Sansec effort. We have been working around the clock to find and triage vulnerabilities in ecommerce platforms, and new AI-assisted research capabilities now let us cover far more code, far faster. Expect more disclosures from this program.

Disclosure timeline

Read more

• Unauthenticated remote code execution in JTL Shop
• Critical backdoor found in MGT Varnish extension
• Adobe patches critical Magento admin takeover via menu injection
• CosmicSting attack & defense overview
• Persistent backdoors injected on Adobe Commerce via new CosmicSting attack