GHSA-r2vg-hvjm-fg38

GHSA-r2vg-hvjm-fg38 · Shopware Customer Orders can be canceled, even if refunds are disabled

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Refunds in general can be enabled through the administration setting `core.cart.enableOrderRefunds` (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php To mitigate this, a check should be added to the `CancelOrderRoute` which verifies that the feature is enabled.

CVSS 4.3 · Moyenne · Correctif disponible

Publication

2025-10-21T18:03:27Z

Mise à jour

2026-09-10T03:50:30.221774498Z

Pile logicielle: php

Vérifiez votre serveur →