GHSA-r2vg-hvjm-fg38

GHSA-r2vg-hvjm-fg38 · Shopware Customer Orders can be canceled, even if refunds are disabled

Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.

Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php To mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.

CVSS 4.3 · Средний · Есть исправление

Опубликовано

2025-10-21T18:03:27Z

Обновлено

2026-09-10T03:50:30.221774498Z

Стек: php

Проверьте свой сервер →