A Shopware Store API endpoint /store-api/handle-payment, implemented in src/Core/Checkout/Payment/SalesChannel/HandlePaymentMethodRoute.php, accepts a user-controlled orderId and forwards it to src/Core/Checkout/Payment/PaymentProcessor.php without verifying that the requester owns the order or is properly authenticated. Because the /store-api/order endpoint enforces ownership checks, this routing flaw creates an inconsistency that allows a normal customer or guest to trigger the payment flow for another user's order. The result is unauthorized payment execution, violating order integrity and potentially enabling financial loss.

Shopware versions 6.6.x prior to 6.6.10.18 and 6.7.x prior to 6.7.10.1 are affected. The vulnerability targets the store‑api/handle‑payment route in the core checkout module and is present in both the shopware:platform and shopware:shopware packages. The issue is fixed in the referenced releases and certain commits that added order‑ownership verification.

The CVSS score of 4.3 indicates moderate risk. The EPSS score is reported as less than 1 %, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The endpoint is publicly reachable via the Store API, so an attacker can exploit the flaw by sending an HTTP request with an arbitrary orderId. No additional privileges are required beyond a normal customer or guest session, meaning the attack surface is relatively broad but exploitation remains unlikely at present.