GHSA-68wv-g3fw-pq7q

Shopware Broken ACL on Document retrieval to access other customers documents

4.0 MediumFix available

GHSA-68wv-g3fw-pq7q is a medium vulnerability (CVSS 4.0) in shopware/core, published April 8, 2025. No source lists public exploit code. Fixed in shopware/core 6.6.10.3.

What does this mean?

Severity: 4.0 MediumCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 6.6.10.3shopware/core +11 more

Description

Impact

It's possible to guess the deepLinkCode of an Document to open documents of other customers

Patches

Update to Shopware 6.6.10.3 or 6.5.8.17

Workarounds

For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`shopware/core` Packagist	6.6.0.0 up to 6.6.10.3	6.6.10.3
`shopware/platform` Packagist	6.6.0.0 up to 6.6.10.3	6.6.10.3
`shopware/core` Packagist	6.7.0.0-rc1 up to 6.7.0.0-rc2	6.7.0.0-rc2
`shopware/platform` Packagist	6.7.0.0-rc1 up to 6.7.0.0-rc2	6.7.0.0-rc2
`shopware/core` Packagist	before 6.5.8.17	6.5.8.17
`shopware/platform` Packagist	before 6.5.8.17	6.5.8.17
`shopware/core` Packagist	6.6.0.0 up to 6.6.10.3, plus listed versions v6.6.0.0v6.6.0.1v6.6.0.2v6.6.0.3v6.6.1.0 Show 20 moreShow less v6.6.1.1v6.6.1.2v6.6.10.0v6.6.10.1v6.6.10.2v6.6.2.0v6.6.3.0v6.6.3.1v6.6.4.0v6.6.4.1v6.6.5.0v6.6.5.1v6.6.6.0v6.6.6.1v6.6.7.0v6.6.7.1v6.6.8.0v6.6.8.1v6.6.8.2v6.6.9.0	6.6.10.3
`shopware/platform` Packagist	6.6.0.0 up to 6.6.10.3, plus listed versions v6.6.0.0v6.6.0.1v6.6.0.2v6.6.0.3v6.6.1.0 Show 20 moreShow less v6.6.1.1v6.6.1.2v6.6.10.0v6.6.10.1v6.6.10.2v6.6.2.0v6.6.3.0v6.6.3.1v6.6.4.0v6.6.4.1v6.6.5.0v6.6.5.1v6.6.6.0v6.6.6.1v6.6.7.0v6.6.7.1v6.6.8.0v6.6.8.1v6.6.8.2v6.6.9.0	6.6.10.3
`shopware/core` Packagist	6.7.0.0-rc1 up to 6.7.0.0-rc2, plus listed versions v6.7.0.0-rc1	6.7.0.0-rc2
`shopware/platform` Packagist	6.7.0.0-rc1 up to 6.7.0.0-rc2, plus listed versions v6.7.0.0-rc1	6.7.0.0-rc2
`shopware/core` Packagist	before 6.5.8.17, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less 6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1	6.5.8.17
`shopware/platform` Packagist	before 6.5.8.17, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less 6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1	6.5.8.17

What each source reports

GitHub Advisories Score used4.0

Shopware Broken ACL on Document retrieval to access other customers documents

Impact

It's possible to guess the deepLinkCode of an Document to open documents of other customers

Patches

Update to Shopware 6.6.10.3 or 6.5.8.17

Workarounds

For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Record: GHSA-68wv-g3fw-pq7q
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-284
Updated: 2026-11-02

OSV4.0

Shopware Broken ACL on Document retrieval to access other customers documents

Impact

It's possible to guess the deepLinkCode of an Document to open documents of other customers

Patches

Update to Shopware 6.6.10.3 or 6.5.8.17

Workarounds

For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Record: GHSA-68wv-g3fw-pq7q
CVSS 3.1: 4.0 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness: CWE-284
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

This page doesn't list everything

Left out here: 132 versions. The JSON record has them.