Shopware Unauthenticated Order Data Access Vulnerability

A vulnerability in Shopware prior to versions 6.7.8.1 and 6.6.10.15 allows unauthenticated customers to access orders of other customers. This issue arises from an inadequate validation of filter types on the store-api.order endpoint, particularly related to deepLinkCode support. As a result, unauthorized users can retrieve sensitive order information, including customer names, addresses, email addresses, ordered products, order values, numbers, dates, payment and shipping method details, and potentially more custom data depending on the request associations.

Impact

Exploitation of this vulnerability leads to unauthorized access to other customers' order data, mass enumeration of recent orders, and potential scraping of personal information.

Remediation

Users can upgrade to Shopware versions 6.7.8.1 or 6.6.10.15 to address this vulnerability.