CVE-2026-53637
MediumCVSS 6.5Summary
Sylius, an Open Source eCommerce Framework on Symfony, contains an improper workflow enforcement vulnerability in the cart FormComponent. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order's changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order.
Risk Assessment
An authenticated customer could manipulate completed orders, potentially leading to data integrity issues and operational problems.
Recommendation
Upgrade Sylius to version 2.0.18, 2.1.15, 2.2.6 or later. As a workaround, copy the patched FormComponent into the src/ directory and override the service definition.
Other vulnerabilities in Sylius
See all- CVE-2026-53639Medium
Sylius, an open-source eCommerce framework on Symfony, contains a vulnerability in versions from 2.0.0 to 2.0.17, 2.1.14, and 2.2.5. The GET and PUT API endpoints for payment requests do not verify resource ownership based on the hash, allowing an attacker to read payment and order data and modify redirect fields. A similar issue affects payment creation, where order ownership is not checked.
- CVE-2026-53638Medium
Sylius, an Open Source eCommerce Framework on Symfony, contains an authorization bypass vulnerability in the shop account API. The PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint does not validate that the chosen payment method is enabled for the order's channel, allowing an authenticated customer to assign any globally enabled payment method to their order, including methods excluded by the store operator.
Original NVD description (English source)
Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.