Incorrect authorization in Sylius - CVE-2026-53638
Published: September 2, 2026
Vulnerability identifier: #VU146810
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-53638
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass channel-based payment method restrictions on their own placed order.
The vulnerability exists due to improper access control in the shop account orders API endpoint when changing the payment method for an order in the STATE_NEW state. A remote user can send a crafted PATCH request selecting a globally enabled out-of-channel payment method to bypass channel-based payment method restrictions on their own placed order.
The issue affects the PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint for orders that have been placed but not yet paid.
Affected software
Sylius
How to mitigate CVE-2026-53638
Install security update from vendor's website.
Sylius - addressed in versions 2.0.18, 2.1.15, 2.2.6