GHSA-27gv-mg7w-mm34

Suggest an improvement
Source
https://github.com/advisories/GHSA-27gv-mg7w-mm34
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-27gv-mg7w-mm34/GHSA-27gv-mg7w-mm34.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-27gv-mg7w-mm34
Aliases
Published
2025-08-06T09:30:37Z
Modified
2026-09-10T03:50:26Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Shopware race condition bypasses voucher restrictions
Details

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

Database specific 
{
    "cwe_ids":  [
        "CWE-362"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-08-06T17:37:39Z",
    "nvd_published_at":  "2025-08-06T08:15:30Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / shopware/platform

Package

Name
shopware/platform
Purl
pkg:composer/shopware/platform

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
6.6.10.4

Affected versions

v6.*
v6.0.0+ea2
v6.1.0-rc1
v6.1.0-rc2
v6.1.0-rc3
v6.1.0-rc4
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.2.0-RC1
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.5.1.0
v6.5.1.1
v6.5.2.0
v6.5.2.1
v6.5.3.0
v6.5.3.1
v6.5.3.2
v6.5.3.3
v6.5.4.0
v6.5.4.1
v6.5.5.0
v6.5.5.1
v6.5.5.2
v6.5.6.0
v6.5.6.1
v6.5.7.0
v6.5.7.1
v6.5.7.2
v6.5.7.3
v6.5.7.4
v6.5.8.0
v6.5.8.1
v6.5.8.2
v6.5.8.3
v6.5.8.4
v6.5.8.5
v6.5.8.6
v6.5.8.7
v6.5.8.8
v6.5.8.9
v6.5.8.10
v6.5.8.11
v6.5.8.12
v6.5.8.13
v6.5.8.14
v6.5.8.15
v6.5.8.16
v6.5.8.17
v6.5.8.18
v6.5.8.19
v6.6.0.0-rc1
v6.6.0.0-rc2
v6.6.0.0-rc3
v6.6.0.0-rc4
v6.6.0.0-rc5
v6.6.0.0-rc6
v6.6.0.0-rc7
v6.6.0.0
v6.6.0.1
v6.6.0.2
v6.6.0.3
v6.6.1.0
v6.6.1.1
v6.6.1.2
v6.6.2.0
v6.6.3.0
v6.6.3.1
v6.6.4.0
v6.6.4.1
v6.6.5.0
v6.6.5.1
v6.6.6.0
v6.6.6.1
v6.6.7.0
v6.6.7.1
v6.6.8.0
v6.6.8.1
v6.6.8.2
v6.6.9.0
v6.6.10.0
v6.6.10.1
v6.6.10.2
v6.6.10.3
v6.6.10.4
6.*
6.3.0.0
6.3.0.1
6.3.0.2
6.3.1.0
6.3.1.1
6.3.2.0
6.3.2.1
6.3.3.0
6.3.3.1
6.3.4.0
6.3.4.1
6.3.5.0
6.3.5.1
6.3.5.2
6.3.5.3
6.3.5.4
6.4.0.0-RC1
6.4.0.0
6.4.1.0
6.4.1.1
6.4.1.2
6.4.2.0
6.4.2.1
6.4.3.0
6.4.3.1
6.4.4.0
6.4.4.1
6.4.5.0
6.4.5.1
6.4.6.0
6.4.6.1
6.4.7.0
6.4.8.0
6.4.8.1
6.4.8.2
6.4.9.0
6.4.10.0
6.4.10.1
6.4.11.0
6.4.11.1
6.4.12.0
6.4.13.0
6.4.14.0
6.4.15.0
6.4.15.1
6.4.15.2
6.4.16.0
6.4.16.1
6.4.17.0
6.4.17.1
6.4.17.2
6.4.18.0
6.4.18.1
6.4.19.0
6.4.20.0
6.4.20.1
6.4.20.2
6.5.0.0-rc1
6.5.0.0-rc2
6.5.0.0-rc3
6.5.0.0-rc4
6.5.0.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-27gv-mg7w-mm34/GHSA-27gv-mg7w-mm34.json"