CVE-2026-68501

MediumCVSS 6.5

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

Sylius Mollie Plugin prior to versions 2.2.8, 3.2.4, and 3.3.1 exposes GET /{_locale}/thank-you and GET /{_locale}/get-code endpoints that look up sequential orderId values without ownership or session checks. This exposes order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email.

Risk Assessment

The organization risks leakage of customer personal data (first name, last name, email), which may violate data protection regulations (e.g., GDPR) and harm reputation.

Recommendation

Update Sylius Mollie Plugin to version 2.2.8, 3.2.4, or 3.3.1 (depending on the branch used), which include a fix that checks ownership and session.

Other vulnerabilities in Sylius Mollie Plugin

CVE-2026-68500High
The Sylius Mollie Plugin prior to versions 2.2.8, 3.2.4, and 3.3.1 accepts attacker-controlled id and orderId parameters in the POST /{_locale}/update-payment payment webhook but does not verify that the Mollie payment belongs to the referenced Sylius order. An unauthenticated attacker can use any valid paid Mollie payment ID to mark a victim order as paid without transferring funds.

Original NVD description (English source)

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.