Shopware is an open commerce platform. In versions before 6.6.10.18 and 6.7.10.1, a non‑admin API user who has the integration:create ACL privilege can raise their privileges to full administrator by creating an integration that sets the admin flag to true through the Sync API POST /api/_action/sync. Although the standard integration endpoint POST /api/integration blocks such a flag change, the SyncController::sync() path bypasses this check, routing the request through SyncService to EntityWriter::upsert(). Because the IntegrationDefinition class does not provide write protection for the admin field, the request succeeds. This access‑control flaw, classified as CWE‑862, allows the attacker to permanently gain administrator rights, fully compromising the platform’s confidentiality, integrity, and availability.

Shopware Platform and Shopware eCommerce Platform versions prior to 6.6.10.18 and 6.7.10.1 are affected. Integration creation through the Sync API in those releases can be abused to elevate privileges. The issue was addressed and fixed in the 6.6.10.18 and 6.7.10.1 releases.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is listed as < 1%, implying a very low probability of exploitation at the time of reporting. The vulnerability is not currently listed in the CISA KEV catalog. Likely exploitation requires authentic API access with the integration:create privilege, and the attack would be conducted remotely by sending crafted POST requests to the Sync endpoint. If an attacker already has limited API rights, the vulnerability can be leveraged to elevate to full administrator status.