Dear Customers,
Dear Partners,
As part of an internal review and following a reported finding, we have further strengthened a process within the employee management component.
To address this, we are providing a security patch for the B2Bsellers Suite with immediate effect.
What has changed?
This patch updates the permissions for managing global employee profile data.
From now on, administrators can no longer modify sensitive account information of existing employees through the employee management interface. This includes, in particular:
Email address
Password
These details can now only be changed by the respective employee within their own account.
In addition, the corresponding input fields have been removed from the B2B Platform.
Why this change?
This update further improves the security of cross company employee assignments and establishes a clear separation between organization specific administrative data and an employee's personal account information.
Recommendation
We strongly recommend that all customers and partners install this patch as soon as possible.
At the same time, we are already working on a further enhancement of the employee management process. In an upcoming release, adding an existing employee to another company will be changed to an invitation based workflow. The employee will first need to explicitly accept the invitation before being assigned to the additional company.
Download
You can download the patches direct:
Download - Patch for Shopware 6.5
Download - Patch for Shopware 6.6
Download - Patch for Shopware 6.7
If you have any questions, our support team will be happy to assist you.
Thank you for your continued trust in B2Bsellers.
