CVE-2024-22407 - CVE House
Back to Database
Status published Medium CVE-2024-22407

Broken Access Control order API in Shopware

Vulnerability Description

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-22407

Credits & Attribution

No credits recorded in the NVD database.

References

More from shopware

View All →
CVE-2025-67648
Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page
High 7.1
CVE-2025-32378
Shopware's default newsletter opt-in settings allow for mass sign-up abuse
Medium 6.9
CVE-2025-30151
Shopware allows Denial Of Service via password length
High 7.5
CVE-2025-30150
Shopware 6 allows attackers to check for registered accounts through the store-api
Medium 5.5
CVE-2024-42357
Shopware vulnerable to blind SQL-injection in DAL aggregations
High 7.3

Affected Vendor

Affected Software

shopware
Vulnerable Versions:
< 6.5.7.4

Timeline

Official Publish: January 16th, 2024
Last Modified: November 13th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-284

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1213 Data from Information Repositories
Collection
T1565.002 Stored Data Manipulation
Impact