Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6v1h-g9hh-5kad
Vulnerability ID VCID-6v1h-g9hh-5kad
Aliases CVE-2024-22407
GHSA-3867-jc5c-66qf
Summary Improper Access Control Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for orders are still able to change the order state. This issue has been addressed and users are advised to update to Shopware 6.5.7.4. For older versions of 6.1, 6.2, 6.3 and 6.4 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-284 Improper Access Control
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00108 https://api.first.org/data/v1/epss?cve=CVE-2024-22407
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-3867-jc5c-66qf
cvssv3.1_qr MODERATE https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qf
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-22407
https://github.com/shopware/core/commit/78142489264f9262eaaa436ba036df40026a06be
https://github.com/shopware/shopware/commit/fb25e24ca51650009ffa2520f1e67b48b911354a
CVE-2024-22407 https://nvd.nist.gov/vuln/detail/CVE-2024-22407
GHSA-3867-jc5c-66qf https://github.com/advisories/GHSA-3867-jc5c-66qf
GHSA-3867-jc5c-66qf https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qf
No exploits are available.
Exploit Prediction Scoring System (EPSS)
Percentile 0.28762
EPSS Score 0.00108
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:03:04.813568+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/shopware/core/CVE-2024-22407.yml 38.6.0