MediumGHSA-5297-wrrp-rcj7CVE-2024-31447

Shopware Improper Session Handling in store-api account logout

Published 8 Apr 2024 · Updated 10 Sept 2026

Affected packages

shopware/coreComposer
Affected
>=6.3.5.0 <6.5.8.8
Fixed in
6.5.8.8
Update to the fixed version for your release line, for example:composer require shopware/core:^6.5.8.8
shopware/platformComposer
Affected
>=6.3.5.0 <6.5.8.8
Fixed in
6.5.8.8
Update to the fixed version for your release line, for example:composer require shopware/platform:^6.5.8.8
shopware/coreComposer
Affected
>=6.6.0.0-rc1 <6.6.1.0
Fixed in
6.6.1.0
Update to the fixed version for your release line, for example:composer require shopware/core:^6.6.1.0
shopware/platformComposer
Affected
>=6.6.0.0-rc1 <6.6.1.0
Fixed in
6.6.1.0
Update to the fixed version for your release line, for example:composer require shopware/platform:^6.6.1.0

Details

Impact

When a authentificated request is made to POST /store-api/account/logout, the cart will be cleared, but the User won't be logged out. This affects only the direct store-api usage, as the PHP Storefront listens additionally on CustomerLogoutEvent and invalidates the session additionally.

Patches

The problem has been fixed with Shopware 6.6.1.0 and 6.5.8.8.

Workarounds

When you are not able to update, you can install the latest version of the Shopware Security Plugin.

Is GHSA-5297-wrrp-rcj7 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected shopware/core, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.