EUVD-2026-87941
GHSA-3jc5-2834-w7f2
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network endpoint, no authentication beyond a self-owned order token (PR:N), but exploitation depends on gateway-specific refund wiring (AC:H); impact is integrity/financial (I:H), no confidentiality or availability loss.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
6DescriptionCVE.org
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
Articles & Coverage 1
AnalysisAI
Incorrect authorization in the Sylius Shop API lets anyone holding an order token submit arbitrary payment actions - most notably refunds - against their own completed orders through POST /api/v2/shop/orders/{tokenValue}/payment-requests. Affected releases are Sylius versions before 2.1.16 and before 2.2.9; the endpoint accepted any caller-supplied action value with order ownership as the only check, so where a payment gateway wires a refund-class action into its action-indexed command provider the gateway executes the refund while Sylius still records the order as paid, producing direct financial loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) a valid order token for a paid order - trivially obtained by any customer for their own completed purchase, so no account authentication is needed beyond token possession; and (2) the deployed payment gateway must map a refund-class action (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine business-logic authorization flaw (CWE-863) rather than an inflated high-CVSS score, but its real-world exploitability is gated by a specific gateway configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Sylius 2.1.16 or 2.2.9, which enforce an allowlist of payment request actions acceptable from the shop context; the shipped default allows only capture, authorize, status and notify and rejects everything else with 422 Unprocessable Entity. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether the environment runs a Sylius version below 2.1.16 or below 2.2.9 and whether any active payment gateway maps refund-class operations into an action-indexed command provider; if so, block or tightly restrict POST requests to /api/v2/shop/orders/{tokenValue}/payment-requests at the WAF or reverse proxy and allow-list only the specific action values the business legitimately requires, while pulling the last 90 days of gateway refund transactions and reconciling them against Sylius order and payment records to detect any unauthorized refunds. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today