GHSA-r2vg-hvjm-fg38

GHSA-r2vg-hvjm-fg38 · Shopware Customer Orders can be canceled, even if refunds are disabled

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php To mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.

CVSS 4.3 · Mittel · Korrektur verfügbar

Veröffentlicht

2025-10-21T18:03:27Z

Aktualisiert

2026-09-10T03:50:30.221774498Z

Technologie-Stack: php

Prüfen Sie Ihren Server →