Vulnerability · Published Oct 11, 2026 · Assigned by VulnCheck

CVE-2026-108724Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in Sylius from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 74.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

Affected products (as reported)

Vendor	Product	Versions
Sylius	Sylius	0 – through 2.3.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://hackmd.io/@haind/sylius-shop-product-review-item-moderation-bypass third-party-advisory
https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Doctrine/ORM/QueryExtension/Shop/ProductReview/AcceptedExtension.php#L25-L59 technical-description
https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Resources/config/services/extensions.php#L63-L67 technical-description
https://github.com/Sylius/Sylius product
VulnCheck Advisory: Sylius through 2.3.0 Authorization Bypass via Shop API Product-Review Endpoint third-party-advisory