EUVD-2026-51299
GHSA-rc52-c4hv-w89p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated webhook with no user interaction gives AV:N/AC:L/PR:N/UI:N; forging paid status corrupts order integrity (I:H) with no confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
AnalysisAI
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticated attacker mark any victim order as paid without transferring funds. The plugin's POST /{_locale}/update-payment webhook trusts attacker-supplied id and orderId parameters and never verifies that the referenced Mollie payment belongs to the referenced Sylius order, so possession of any single valid paid Mollie payment ID is enough to forge a paid status on arbitrary orders. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the root cause is straightforward and the impact is a direct financial-fraud primitive against the shop.
Technical ContextAI
Sylius is a Symfony-based open-source e-commerce platform; the MolliePlugin (CPE cpe:2.3:a:sylius:mollieplugin) integrates the Mollie payment gateway to handle checkout, QR-code payments, and asynchronous payment-status webhooks. The vulnerability is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the shop payment webhook resolves an order from a client-supplied orderId and applies a payment status derived from a client-supplied Mollie payment id without binding the two together. The fix in PaymentWebhookController adds a check that the stored payment_mollie_id (falling back to the order's MolliePaymentId) equals the incoming Mollie payment id, ignoring mismatches with an HTTP 200. The same PRs also harden the thank-you and QR-code endpoints, replacing guessable integer orderId lookups with the non-guessable orderToken (tokenValue), which had allowed access to arbitrary orders.
RemediationAI
Vendor-released patch: upgrade to Sylius MolliePlugin 2.2.8 (2.2.x branch), 3.2.4 (3.2.x branch), or 3.3.1 (3.3.x branch) to match your major version, then run yarn install and yarn build because the bundled assets/shop/js/mollie/app.js changed from orderId to orderToken (per UPGRADE-2.2.md). The upstream fixes are in PRs #351, #352, and #354 and commits 01316b3, 153c754, and d1f7753. If you have overridden PageRedirectController, QrCodeAction, or the shop JS, or link to the thank-you/get-code endpoints directly, migrate those callers from ?orderId= to ?orderToken=. If immediate patching is impossible, a targeted compensating control is to restrict the POST /{_locale}/update-payment webhook to Mollie's published source IP ranges (trade-off: does not stop an attacker who already knows a valid payment ID and can reach the endpoint, and may break legitimate callbacks if Mollie's IPs change), and to enforce server-side that a Mollie payment id is bound to its order before applying paid status. See the advisory at https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-rc52-c4hv-w89p.
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user acco
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expressio
Sylius is an open source eCommerce platform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable,
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. Rated medium severi
Sylius is an open source eCommerce platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitabl
SyliusGridBundle is a package of generic data grids for Symfony applications. Rated critical severity (CVSS 9.8), this v
Sylius eCommerce Framework is vulnerable to a race condition in promotion and coupon usage limit enforcement, where conc
sylius/paypal-plugin is a paypal plugin for the Sylius development platform. Rated high severity (CVSS 7.5), this vulner
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentica
Authenticated users in Sylius eCommerce can access sensitive customer data belonging to other users through unvalidated
Open redirect vulnerabilities in Sylius eCommerce Framework allow unauthenticated attackers to redirect users to arbitra
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today