Threats affecting pkg:github/shopware/core

CVE-2026-31887 is a high-severity authorization vulnerability in Shopware core versions prior to 6.7.8.1 and 6.6.10.15. It allows unauthenticated users to access orders belonging to other customers via insufficient filtering on the store-api.order endpoint, specifically related to deepLinkCode support. The flaw stems from an incorrect authorization check (CWE-863) that fails to properly restrict access to order data.