CVE-2026-68500
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
The Sylius Mollie Plugin prior to versions 2.2.8, 3.2.4, and 3.3.1 accepts attacker-controlled id and orderId parameters in the POST /{_locale}/update-payment payment webhook but does not verify that the Mollie payment belongs to the referenced Sylius order. An unauthenticated attacker can use any valid paid Mollie payment ID to mark a victim order as paid without transferring funds.
Risk Assessment
The risk involves the possibility of tricking the system into marking an order as paid, potentially leading to financial loss and integrity compromise of the order process.
Recommendation
Immediately update Sylius Mollie Plugin to version 2.2.8, 3.2.4, or 3.3.1, which include the fix that verifies payment ownership.
Other vulnerabilities in Sylius Mollie Plugin
Original NVD description (English source)
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.