Incorrect authorization in Sylius - #VU159506
Published: November 5, 2026
Vulnerability details
The vulnerability allows a Sylius shop customer, or a guest holding an order token, to bypass payment method restrictions for their own placed order and create a payment request using a method that is disabled or not assigned to the order's channel. The request is processed through that method's configured gateway, allowing payment routing through a gateway the merchant did not intend to offer on that channel, such as one intended for another market or taken out of service.
The vulnerability exists due to missing payment method eligibility validation on the AddPaymentRequest command. AddPaymentRequestHandler retrieves the caller-selected method using an unfiltered findOneBy lookup by code and creates a payment request without checking whether the method is enabled and assigned to the order's channel. A remote attacker can act as a shop customer or a guest holding the order token and submit an existing store payment method's code as paymentMethodCode to POST /api/v2/shop/orders/{tokenValue}/payment-requests for their own order.
The ChoosePaymentMethod and ChangePaymentMethod commands use the ChosenPaymentMethodEligibility constraint, which resolves eligible methods through sylius.resolver.payment_methods and rejects unsupported selections with HTTP 422; AddPaymentRequest lacks this constraint. Payment ownership is still verified, and the payment must belong to the order identified by the token. The issue is therefore a payment method restriction bypass on the caller's own order, not cross-customer access.