MEDIUM

GHSA-27gv-mg7w-mm34

Shopware race condition bypasses voucher restrictions

Details

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/shopware/platform

Introduced in: 0

No fixed version published yet for shopware/platform (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-7954[ADVISORY]
https://github.com/shopware/shopware/issues/11245[WEB]
https://github.com/shopware/shopware[PACKAGE]
http://seclists.org/fulldisclosure/2025/Aug/17[WEB]