SB2026090295 - Multiple vulnerabilities in Sylius
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-53637)
CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify or delete a completed order.
The vulnerability exists due to improper enforcement of behavioral workflow in the Cart FormComponent when handling stale cart state after the underlying order has been completed. A remote user can keep the cart page open, complete checkout in another tab, and then modify the stale cart to modify or delete a completed order.
The issue occurs when the browser still displays an outdated cart while the order state has already changed in the background.
2) Incorrect authorization (CVE-ID: CVE-2026-53638)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass channel-based payment method restrictions on their own placed order.
The vulnerability exists due to improper access control in the shop account orders API endpoint when changing the payment method for an order in the STATE_NEW state. A remote user can send a crafted PATCH request selecting a globally enabled out-of-channel payment method to bypass channel-based payment method restrictions on their own placed order.
The issue affects the PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint for orders that have been placed but not yet paid.
3) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-53639)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authorization and modify payment request data, potentially leading to disclosure of order information and redirection of buyers to attacker-controlled URLs.
The vulnerability exists due to improper access control in the shop payment request API endpoints when handling requests that reference payment request hashes or order token values from the URL without verifying ownership. A remote attacker can obtain a valid hash or token value out-of-band and send crafted GET, PUT, or POST requests to bypass authorization and modify payment request data, potentially leading to disclosure of order information and redirection of buyers to attacker-controlled URLs.
The payment request hash is a UUID that must first be obtained out-of-band, such as from logs, shared links, referrer headers, or a co-located client.
Remediation
Install update from vendor's website.