Shopware, an open commerce platform, has a vulnerability in order state transition endpoints. Prior to versions 6.6.10.18 and 6.7.10.1, routes such as /api/_action/order/{orderId}/state/{transition} lack the PlatformRequest::ATTRIBUTE_ACL declaration and do not perform an explicit privilege check. Consequently, the AclAnnotationValidator exits when ACL metadata is missing, letting low‑privileged users who do not hold order:update, order_transaction:update, or order_delivery:update permissions trigger StateMachineRegistry::transition() writes in SYSTEM_SCOPE. This allows attackers to alter order, transaction, or delivery states without authorization. The flaw maps to CWE‑862, a privilege‑or‑permission‑related error.

Shopware's open‑commerce platform is affected, specifically the shopware:platform and shopware:shopware products. Versions prior to 6.6.10.18 and 6.7.10.1 are vulnerable. The issue was fixed in 6.6.10.18 and 6.7.10.1, so any deployments earlier than those releases are at risk.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is less than 1 %, suggesting a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Low‑privileged users lacking the order:update, order_transaction:update, or order_delivery:update permissions can invoke transition routes, which perform state changes in SYSTEM_SCOPE without permission checks. The flaw allows unauthorized state transitions because the ACL metadata is omitted from the route definition.