{"action":"Upgrade shopware/core to 6.5.7.4 or later.","affected":[{"fixed":"6.5.7.4","introduced":"0"}],"component":"shopware/core","cve_ids":["CVE-2024-22407"],"ecosystem":"Packagist","epss":0.004,"exploited":false,"fixed_versions":["6.5.7.4"],"ghsa_id":"GHSA-3867-jc5c-66qf","id":"tcs_01M5KESRQ7W2DCNFWKPPXEYKYW","modified_at":"2026-09-10T03:50:04.658562881Z","published_at":"2024-01-17T20:29:33Z","references":["https://osv.dev/vulnerability/GHSA-3867-jc5c-66qf","https://github.com/shopware/shopware/security/advisories/GHSA-3867-jc5c-66qf","https://nvd.nist.gov/vuln/detail/CVE-2024-22407","https://github.com/shopware/core/commit/78142489264f9262eaaa436ba036df40026a06be","https://github.com/shopware/shopware/commit/fb25e24ca51650009ffa2520f1e67b48b911354a","https://github.com/shopware/shopware"],"severity":{"label":"medium","score":4.9},"sources":[{"source":"osv","source_id":"GHSA-3867-jc5c-66qf","url":"https://osv.dev/vulnerability/GHSA-3867-jc5c-66qf"}],"summary":"Broken Access Control order API in Shopware"}