SB2026090296 - Multiple vulnerabilities in Sylius
Published: September 2, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) Improper Authorization (CVE-ID: N/A)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to trigger unauthorized refunds.
The vulnerability exists due to improper authorization in the Shop API payment request endpoint when handling payment request actions supplied by the caller. A remote user can send a specially crafted request with an arbitrary action value such as refund to trigger unauthorized refunds.
Exploitation requires the Shop API to be enabled, a token for an order owned by the user, and a payment gateway that wires a refund-class action into its action-indexed command provider.
2) Improper Enforcement of Behavioral Workflow (CVE-ID: N/A)
CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to manipulate payment status and mark an order as fully paid for an inflated total.
The vulnerability exists due to improper enforcement of behavioral workflow in OrderPaymentProcessor and OrderPaymentsRemover when recalculating an order after a gateway transaction has started. A remote attacker can pay a smaller legitimate amount and then enlarge the same order to manipulate payment status and mark an order as fully paid for an inflated total.
The issue occurs because the captured amount is not verified against the order\'s current total when the gateway later reports the transaction as successful.
3) Authentication Bypass by Spoofing (CVE-ID: N/A)
CWE-ID: CWE-290 - Authentication Bypass by Spoofing
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain administrative access to the API.
The vulnerability exists due to authentication bypass by spoofing in JWT authentication across the admin and shop API firewalls when processing JWTs issued for a different firewall. A remote user can register a shop customer account with an administrator\'s e-mail address and present the resulting token to the Admin API to gain administrative access to the API.
Exploitation is possible when the API is enabled, shop registration is available, and an administrator e-mail address can be learned or guessed.
4) Weak Password Recovery Mechanism for Forgotten Password (CVE-ID: N/A)
CWE-ID: CWE-640 - Weak password recovery mechanism
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to take over an administrator account.
The vulnerability exists due to weak password recovery mechanism in the administrator password-reset email link generation when building the reset URL from the request Host header. A remote attacker can trigger a password-reset email and supply a crafted Host header so the reset link points to an attacker-controlled domain to take over an administrator account.
User interaction is required because the administrator must click the crafted reset link in the genuine password-reset email.
Remediation
Install update from vendor's website.