Vulnerability · Published Sep 8, 2026 · Assigned by GitHub_M

CVE-2026-53637Sylius: Cart FormComponent allows modification or deletion of an already-completed order

Medium 6.5

In plain English

A medium-severity security flaw in Sylius from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 69.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Sylius is an Open Source eCommerce Framework on Symfony. Versions 2.0.0 through 2.0.17, 2.1.0 through 2.1.14, and 2.2.0 through 2.2.5 contain an improper workflow enforcement vulnerability in the cart `FormComponent`. When an order is completed while its cart page remains open, the stale LiveComponent does not detect the order’s changed state and continues to permit cart actions, allowing an authenticated customer to modify or permanently delete an already completed order. Versions 2.0.18, 2.1.15, and 2.2.6 contain a patch. As a workaround, deployments can copy the patched `FormComponent` into the application's `src/` directory and override the `sylius_shop.twig.component.cart.form` service definition to use that class.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	sylius/sylius	2.0.18	GHSA-5597-7rmh-97q5
Packagist	sylius/sylius	2.1.15	GHSA-5597-7rmh-97q5
Packagist	sylius/sylius	2.2.6	GHSA-5597-7rmh-97q5

Affected products (as reported)

Vendor	Product	Versions
Sylius	Sylius	>= 2.0.0, < 2.0.18>= 2.1.0, < 2.1.15>= 2.2.0, < 2.2.6

Weakness: CWE-672, CWE-841 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/Sylius/Sylius/security/advisories/GHSA-5597-7rmh-97q5 x_refsource_CONFIRM