EUVD-2026-51301
GHSA-x83g-979r-f5fh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessFingerprint target Sylius shop with MolliePlugin
-
DeliveryEnumerate sequential integer orderId via GET /{_locale}/thank-you?orderId=N
-
ExploitExtract orderToken (tokenValue) from each response
-
ExecutionQuery GET /{_locale}/register-after-checkout/{tokenValue}
-
ImpactHarvest customer name and email for all orders
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | No special configuration is required beyond having the Sylius MolliePlugin installed and the Mollie payment gateway enabled on the shop - which is the expected production configuration for any merchant deploying this plugin. The thank-you and QR-code endpoints are intentionally unauthenticated, as they serve post-checkout flows where customers may not be logged in. Exploitation requires only HTTP network access to the shop's public URL. What limits exploitation: the attacker must know the base shop URL and locale prefix (/{_locale}/); the data exposed is limited to name and email (no payment card data or order totals are documented as leaked); shops with very few orders (low orderId ceiling) expose proportionally less PII. The CVSS vector PR:N confirms no authentication is required. |
| Impact | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) rates this 6.5 Medium. The AV:N/AC:L/PR:N/UI:N combination is highly concerning - fully unauthenticated, low complexity, no user interaction - and the source code diff confirms this. However, the A:L (availability impact) metric is inconsistent with the description and source code evidence, which describe only a confidentiality impact (PII exposure); no denial-of-service vector is documented. This appears to be a CVSS scoring error. The practical confidentiality impact may be underweighted at C:L given that the attack allows full enumeration of all customer PII across an entire store's order history. No EPSS data was provided, and there is no CISA KEV listing and no known POC, suggesting exploitation has not yet been broadly observed. Nevertheless, the attack is trivially automatable - sequential integer enumeration requires no specialized tooling - placing real-world risk above what the raw CVSS score implies for any publicly-accessible deployment. The absence of KEV status should not be interpreted as low risk; the attack primitive is straightforward and the data exposed (name, email) is directly monetizable for phishing and credential-stuffing campaigns. |
| Exploit ScenarioDerived | An attacker scripts a loop sending GET requests to /{_locale}/thank-you?orderId=1 through ?orderId=N on a target Sylius shop, collecting tokenValue strings from each response without any authentication. For each collected token, the attacker queries GET /{_locale}/register-after-checkout/{tokenValue} to retrieve the customer's first name, last name, and email address, ultimately harvesting the PII of every customer who has ever placed an order. No public POC has been identified, but the technique requires only a basic HTTP client and integer iteration. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.
RemediationAI
Upgrade Sylius MolliePlugin to the patched releases: v2.2.8 (https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8), v3.2.4 (https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4), or v3.3.1 (https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1). After upgrading, run 'yarn install' and 'yarn build' to rebuild frontend assets, as app.js was updated to use the orderToken parameter instead of orderId. If you have overridden assets/shop/js/mollie/app.js or link to these endpoints directly, update all references from ?orderId= to ?orderToken= as described in UPGRADE-2.2.md. If an immediate upgrade is not possible, a compensating control is to block external access to the /{_locale}/thank-you, /{_locale}/get-code, and /{_locale}/register-after-checkout/{tokenValue} endpoints at the web server or WAF layer, though this will break the post-checkout Mollie payment flow for legitimate customers and should only be a temporary measure. The full fix is detailed in the GitHub security advisory at https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic Insecure Direct Object Reference (CWE-639), a subclass of broken object-level authorization. The affected plugin (CPE: cpe:2.3:a:sylius:mollieplugin:*:*:*:*:*:*:*:*) is a Symfony-based PHP plugin integrating the Mollie payment gateway into Sylius e-commerce applications. The root cause is the use of auto-incremented integer order IDs as URL/query parameters in two unauthenticated endpoints: PageRedirectController::thankYouAction (GET /{_locale}/thank-you?orderId=N) and QrCodeAction::fetchQrCodeFromOrder (GET /{_locale}/get-code?orderId=N). Because database auto-increment IDs are sequential and predictable, attackers can trivially enumerate them. The leaked tokenValue from these endpoints is then accepted by the GET /{_locale}/register-after-checkout/{tokenValue} endpoint, which discloses customer PII. The fix - confirmed by GitHub PRs #351, #352, and #354 - replaces the guessable integer orderId with the order's non-guessable orderToken (tokenValue) in both parameters and enforces session-cart ownership checks in the QR-code action.
Know when Sylius gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Network-accessible IDOR with no auth required; only confidentiality impact (PII names/emails) documented - A:L in the official vector is unsupported by the description or code evidence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user acco
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expressio
Sylius is an open source eCommerce platform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable,
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. Rated medium severi
Sylius is an open source eCommerce platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitabl
SyliusGridBundle is a package of generic data grids for Symfony applications. Rated critical severity (CVSS 9.8), this v
Sylius eCommerce Framework is vulnerable to a race condition in promotion and coupon usage limit enforcement, where conc
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticat
sylius/paypal-plugin is a paypal plugin for the Sylius development platform. Rated high severity (CVSS 7.5), this vulner
Unauthenticated remote attackers can read unmoderated and rejected product reviews on Sylius storefronts through 2.3.0 b
Authenticated users in Sylius eCommerce can access sensitive customer data belonging to other users through unvalidated
Exploit-DB