Shopware Customer Orders can be canceled, even if refunds are disabled

MEDIUM 4.3GHSA-r2vg-hvjm-fg38 · Published 21/10/2025 · updated 10/09/2026

In short

GHSA-r2vg-hvjm-fg38 is a MEDIUM (CVSS 4.3) vulnerability affecting shopware/core, shopware/platform.
Fix: update to 6.7.3.1, 6.6.10.7 or later.

Package	Affected versions	Patched versions
shopware/core Packagist	`≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7`	`6.7.3.16.6.10.7`
shopware/platform Packagist	`≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7`	`6.7.3.16.6.10.7`

Refunds in general can be enabled through the administration setting core.cart.enableOrderRefunds (in the cart panel).Which visually shows and hides the button. However, using a custom crafted request, a customer can still cancel his own orders.As this is not checked inside the route (and also not in the controller): https://github.com/shopware/shopware/blob/trunk/src/Storefront/Controller/AccountOrderController.php#L98 https://github.com/shopware/shopware/blob/trunk/src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php

To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7

6.7.3.16.6.10.7

Packagist

≥ 6.7.0.0, < 6.7.3.1< 6.6.10.7

6.7.3.16.6.10.7

Description

To mitigate this, a check should be added to the CancelOrderRoute which verifies that the feature is enabled.

More vulnerabilities in shopware/core

See all →