CVE-2025-7954: Shopware race condition bypasses voucher restrictions
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
Other sources
Shopware race condition bypasses voucher restrictions
— Packagist
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7954?
CVE-2025-7954 is classified as a high severity vulnerability due to its potential to allow attackers to bypass voucher restrictions.
How do I fix CVE-2025-7954?
To fix CVE-2025-7954, update your Shopware installation to the latest version available that addresses this vulnerability.
What versions of Shopware are affected by CVE-2025-7954?
CVE-2025-7954 affects Shopware v6.6.10.4 and possibly earlier versions.
What type of vulnerability is CVE-2025-7954?
CVE-2025-7954 is a race condition vulnerability found in Shopware's voucher system.
What impact does CVE-2025-7954 have on Shopware users?
CVE-2025-7954 allows attackers to exceed usage limitations on vouchers, potentially leading to financial loss for users.