Log in Start free

Vulnerability · Published Jul 30, 2026 · Assigned by GitHub_M

CVE-2026-68500Sylius Mollie Plugin: Payment status forgery via the payment webhook

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in MolliePlugin from Sylius. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistsylius/mollie-plugin2.2.8GHSA-rc52-c4hv-w89p
Packagistsylius/mollie-plugin3.2.4GHSA-rc52-c4hv-w89p
Packagistsylius/mollie-plugin3.3.1GHSA-rc52-c4hv-w89p

Affected products (as reported)

VendorProductVersions
Sylius MolliePlugin < 2.2.8>= 3.0.0, < 3.2.4>= 3.3.0, < 3.3.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References