Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts (CVE-2026-48010) | HOL Guard CVE