high7.5
CVE-2026-100872
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals a…
Impact
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Affected products
| Product | Affected versions |
|---|---|
| Sylius | before 2.1.16 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/Sylius/Sylius
- https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d
- https://github.com/Sylius/Sylius/pull/19216
- https://github.com/Sylius/Sylius/releases/tag/v2.2.9
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4
- https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-overwrite
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4