Improper Authorization in Sylius - #VU146812
Published: September 2, 2026
Vulnerability identifier: #VU146812
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to trigger unauthorized refunds.
The vulnerability exists due to improper authorization in the Shop API payment request endpoint when handling payment request actions supplied by the caller. A remote user can send a specially crafted request with an arbitrary action value such as refund to trigger unauthorized refunds.
Exploitation requires the Shop API to be enabled, a token for an order owned by the user, and a payment gateway that wires a refund-class action into its action-indexed command provider.
Affected software
Sylius
Remediation
Install security update from vendor's website.
Sylius - addressed in versions 2.1.16, 2.2.9