CVE-2026-48010: Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts

June 4, 2026

UserController::upsertUser() writes user data in SYSTEM_SCOPE and does not filter the admin field. A non-admin API user with user:create or user:update ACL permission can set admin: true on new or existing users, escalating to full admin access.

References

github.com/advisories/GHSA-v39m-97p8-gqg7
github.com/shopware/shopware/releases/tag/v6.6.10.18
github.com/shopware/shopware/releases/tag/v6.7.10.1
github.com/shopware/shopware/security/advisories/GHSA-v39m-97p8-gqg7
nvd.nist.gov/vuln/detail/CVE-2026-48010

Code Behaviors & Features

Detect and mitigate CVE-2026-48010 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →