Missing Authorization in Sylius - #VU159504
Published: November 5, 2026
Vulnerability details
The vulnerability allows unauthenticated users to read unpublished Sylius product reviews awaiting moderation or already rejected, including their title, comment, rating, author's first name, reviewed product and dates. Sequential review identifiers allow enumeration of all pending and rejected reviews in a store. Visitors can also read their own and other users' reviews immediately after posting, before moderation. No write, integrity or privilege-escalation impact was identified.
The vulnerability exists due to moderation filtering being applied only to collection queries, while API Platform's default Doctrine item provider loads reviews by identifier without an equivalent accepted-status condition. A remote attacker can request /api/v2/shop/product-reviews/{id} using sequential numeric identifiers to retrieve reviews regardless of moderation status whenever the Shop API is reachable; no account, token or session is required. The collection query extensions, AcceptedExtension and AcceptedProductReviewsExtension, implement QueryCollectionExtensionInterface and are tagged api_platform.doctrine.orm.query_extension.collection, so their filtering does not apply to individual review requests.
Product reviews have a status of new, accepted or rejected, and only accepted reviews are intended to be publicly visible. The collection endpoint /shop/product-reviews correctly restricts results to accepted reviews, unlike the item endpoint. Reachability is a prerequisite: the advisory notes that, on installations also affected by a separate API-disabling bypass, a percent-encoded path could leave the Shop API reachable even with sylius_api.enabled set to false.