A low‑privilege administrator with the user_recovery:read ACL can exploit the Admin API by initiating a user‑recovery action, retrieving the password recovery hash through the search endpoint, and then resetting the target administrator’s password via the recovery password endpoint. This chain allows the attacker to fully take over any admin account. The flaw originates from the hash field being exposed in the Admin API without proper ApiAware or ReadProtection controls, making it an information‑exposure vulnerability (CWE‑200) that enables complete administrative compromise.

Shopware Platform and Shopware Shopware products running versions earlier than 6.6.10.18 or 6.7.10.1 are affected. The issue is fixed in the publicly released 6.6.10.18 and 6.7.10.1 releases.

The CVSS score of 6.8 indicates a moderate severity, though the EPSS probability is below 1%, suggesting that exploitation is low in the wild at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to be authenticated as a low‑privilege admin and would exploit the admin API over the network, making the vector internal but accessible to any user with the user_recovery:read ACL.