Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-100869Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
Medium 5.9
In plain English
A medium-severity incorrect authorization in Sylius from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.3%top 81.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- GitHub Security Advisory (GHSA-2rv4-pjmm-7fxf) vendor-advisory
- https://github.com/Sylius/Sylius/pull/19214 patch, issue-tracking
- https://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75d patch
- Sylius v2.2.9 Release Notes release-notes
- https://github.com/Sylius/Sylius product
- VulnCheck Advisory: Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API third-party-advisory