CVE-2024-42354
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
- Record
CVE-2024-42354- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-2597
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
- Record
EUVD-2024-2597- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhcq-ph6w-494g
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
Impact
The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON.
The processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used.
This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions.
Patches
Update to Shopware 6.6.5.1 or 6.5.8.13.
Workarounds
For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
- Record
GHSA-hhcq-ph6w-494g- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
- Record
CVE-2024-42354- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1 and 6.5.8.13, the processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used. This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions. Update to Shopware 6.6.5.1 or 6.5.8.13 to receive a patch. For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin.
- Record
CVE-2024-42354- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-hhcq-ph6w-494g
Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api
Impact
The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON.
The processing of the Criteria did not considered ManyToMany associations and so they were not considered properly and the protections didn't get used.
This issue cannot be reproduced with the default entities by Shopware, but can be triggered with extensions.
Patches
Update to Shopware 6.6.5.1 or 6.5.8.13.
Workarounds
For older versions of 6.2, 6.3, and 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
- Record
GHSA-hhcq-ph6w-494g- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/corePackagist |
through 6.5.8.12 | 6.5.8.13 |
shopware/platformPackagist |
through 6.5.8.12 | 6.5.8.13 |
shopware/corePackagist |
6.6.0.0 to 6.6.5.0 | 6.6.5.1 |
shopware/platformPackagist |
6.6.0.0 to 6.6.5.0 | 6.6.5.1 |
shopware/corePackagist |
before 6.5.8.13, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1 |
6.5.8.13 |
shopware/platformPackagist |
before 6.5.8.13, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1 |
6.5.8.13 |
shopware/corePackagist |
6.6.0.0 up to 6.6.5.1, plus listed versions v6.6.0.0v6.6.0.1v6.6.0.2v6.6.0.3v6.6.1.0 Show 8 moreShow lessv6.6.1.1v6.6.1.2v6.6.2.0v6.6.3.0v6.6.3.1v6.6.4.0v6.6.4.1v6.6.5.0 |
6.6.5.1 |
shopware/platformPackagist |
6.6.0.0 up to 6.6.5.1, plus listed versions v6.6.0.0v6.6.0.1v6.6.0.2v6.6.0.3v6.6.1.0 Show 8 moreShow lessv6.6.1.1v6.6.1.2v6.6.2.0v6.6.3.0v6.6.3.1v6.6.4.0v6.6.4.1v6.6.5.0 |
6.6.5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-42354 is a medium vulnerability (CVSS 5.3) in Shopware, published August 8, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in shopware/core 6.5.8.13.
References
github.com/shopware/shopware/security/advisories/GHSA-hhcq-ph6w-494g
nvd.nist.gov/vuln/detail/CVE-2024-42354
Left out here: 124 versions. The JSON record has them.