Presentation
The Shopware Store API is the public, customer-facing API used by storefronts and headless integrations. It is reached with a Sales Channel access key rather than a user session.
HDW Sec found an SQL injection in that API: an unauthenticated remote attacker holding a Sales Channel access key can manipulate a database query and read data they should never reach.
Issue(s)
- An aggregation parameter accepted by the Store API reaches the query builder without proper neutralization, so attacker-controlled input becomes part of the SQL statement.
- No user account is required. The only thing needed is a Sales Channel access key.
- That key is not a secret in practice: headless Store API integrations expose it by design, in front end code among other places, so it must not be treated as an access control.
- The scope is changed (
S:C) and confidentiality impact is high: the injection reads beyond the data the Store API is meant to expose.
References
- GitHub advisory: GHSA-p37c-pm9p-7vm5
- Fixed in Shopware 6.6.10.23 and 6.7.13.1, published 2026-08-25. No CVE assigned as of publication.