CVE-2026-100870

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API resolves to that administrator, granting full administrative access.

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

Sylius, an open-source eCommerce framework on Symfony, contains a vulnerability in versions from 2.0.0 to 2.0.17, 2.1.14, and 2.2.5. The GET and PUT API endpoints for payment requests do not verify resource ownership based on the hash, allowing an attacker to read payment and order data and modify redirect fields. A similar issue affects payment creation, where order ownership is not checked.

Sylius, an Open Source eCommerce Framework on Symfony, contains an authorization bypass vulnerability in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint does not validate that the chosen payment method is enabled for the order's channel, allowing an authenticated customer to assign any globally enabled payment method to their order, including methods excluded by the store operator.

Sylius, an Open Source eCommerce Framework on Symfony, contains an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order's changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order.