CVE-2025-7954: Race Condition in Shopware Voucher Submission

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-08-06 · updated 2026-06-17
Weakness: CWE-362

Description

A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.

Affected products

shopware: from 6.6.0.0 before 6.7.2.0 — fixed in 6.7.2.0

How to fix

Upgrade to a fixed version: shopware 6.7.2.0. Check the vendor advisory for mitigations.

References

https://github.com/shopware/shopware/issues/11245
http://seclists.org/fulldisclosure/2025/Aug/17
https://github.com/shopware/shopware/issues/11245

Get alerted when CVE-2025-7954 or the next vulnerability affects your stack