Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck

CVE-2026-100872Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

High 7.5

In plain English

A high-severity insufficient verification of data authenticity in Sylius from Sylius. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 87.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.

Affected products (as reported)

Vendor	Product	Versions
Sylius	Sylius	2.0.0 – before 2.1.162.2.0 – before 2.2.9

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-vv4h-q2x8-74g4) vendor-advisory
https://github.com/Sylius/Sylius/pull/19216 patch, issue-tracking
https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d patch
Sylius v2.2.9 Release Notes release-notes
https://github.com/Sylius/Sylius product
VulnCheck Advisory: Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite third-party-advisory