medium5.9
CVE-2026-100869
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed o…
Impact
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
Affected products
| Product | Affected versions |
|---|---|
| Sylius | before 2.1.16 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Sylius/Sylius
- https://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75d
- https://github.com/Sylius/Sylius/pull/19214
- https://github.com/Sylius/Sylius/releases/tag/v2.2.9
- https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxf
- https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api