Authorization bypass through user-controlled key in Sylius - CVE-2026-53639
Published: September 2, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass authorization and modify payment request data, potentially leading to disclosure of order information and redirection of buyers to attacker-controlled URLs.
The vulnerability exists due to improper access control in the shop payment request API endpoints when handling requests that reference payment request hashes or order token values from the URL without verifying ownership. A remote attacker can obtain a valid hash or token value out-of-band and send crafted GET, PUT, or POST requests to bypass authorization and modify payment request data, potentially leading to disclosure of order information and redirection of buyers to attacker-controlled URLs.
The payment request hash is a UUID that must first be obtained out-of-band, such as from logs, shared links, referrer headers, or a co-located client.