GHSA-r2vg-hvjm-fg38
Shopware Customer Orders can be canceled, even if refunds are disabled
Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):
https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98
https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php
To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Shopware Customer Orders can be canceled, even if refunds are disabled
Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):
https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98
https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php
To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.
- Record
GHSA-r2vg-hvjm-fg38- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
Shopware Customer Orders can be canceled, even if refunds are disabled
Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller):
https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98
https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php
To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.
- Record
GHSA-r2vg-hvjm-fg38- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/platformPackagist | 6.7.0.0 up to 6.7.3.1 | 6.7.3.1 |
shopware/platformPackagist | before 6.6.10.7 | 6.6.10.7 |
shopware/corePackagist | 6.7.0.0 up to 6.7.3.1 | 6.7.3.1 |
shopware/corePackagist | before 6.6.10.7 | 6.6.10.7 |
shopware/platformPackagist | 6.7.0.0 up to 6.7.3.1, plus listed versions v6.7.0.0v6.7.0.1v6.7.1.0v6.7.1.1v6.7.1.2 Show 4 moreShow lessv6.7.2.0v6.7.2.1v6.7.2.2v6.7.3.0 | 6.7.3.1 |
shopware/platformPackagist | before 6.6.10.7, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1 | 6.6.10.7 |
shopware/corePackagist | 6.7.0.0 up to 6.7.3.1, plus listed versions v6.7.0.0v6.7.0.1v6.7.1.0v6.7.1.1v6.7.1.2 Show 4 moreShow lessv6.7.2.0v6.7.2.1v6.7.2.2v6.7.3.0 | 6.7.3.1 |
shopware/corePackagist | before 6.6.10.7, plus listed versions 6.3.0.06.3.0.16.3.0.26.3.1.06.3.1.1 Show 45 moreShow less6.3.2.06.3.2.16.3.3.06.3.3.16.3.4.06.3.4.16.3.5.06.3.5.16.3.5.26.3.5.36.3.5.46.4.0.06.4.0.0-RC16.4.1.06.4.1.16.4.1.26.4.10.06.4.10.16.4.11.06.4.11.16.4.12.06.4.13.06.4.14.06.4.15.06.4.15.16.4.15.26.4.16.06.4.16.16.4.17.06.4.17.16.4.17.26.4.18.06.4.18.16.4.19.06.4.2.06.4.2.16.4.20.06.4.20.16.4.20.26.4.3.06.4.3.16.4.4.06.4.4.16.4.5.06.4.5.1 | 6.6.10.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-r2vg-hvjm-fg38 is a medium vulnerability (CVSS 4.3) in shopware/platform, published October 21, 2025. No source lists public exploit code. Fixed in shopware/platform 6.7.3.1.
References
Left out here: 210 versions. The JSON record has them.