EUVD-2026-51299
GHSA-rc52-c4hv-w89p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessComplete one legitimate Mollie payment
-
DeliveryCapture valid paid Mollie payment id
-
ExploitPOST forged id + victim orderId to /update-payment
-
ExecutionWebhook skips payment-to-order binding check
-
ImpactVictim order marked paid without funds
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Exploitation requires that the target shop runs a vulnerable Sylius MolliePlugin version (<2.2.8, 3.0.0-<3.2.4, or 3.3.0-<3.3.1) with the Mollie shop payment webhook (POST /{_locale}/update-payment) reachable, and that the attacker possesses any one valid, paid Mollie payment ID - most simply obtained by completing a single legitimate Mollie payment against that same shop/merchant. No authentication is needed (PR:N) and no victim interaction is required; the attacker must additionally know or enumerate the target orderId. The limiting factors are therefore: needing at least one genuinely paid Mollie payment id, needing to identify a target order id, and the shop not yet having applied 2.2.8/3.2.4/3.3.1; there is no requirement for elevated privileges or a non-default configuration. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5) is consistent with the description: remote, unauthenticated, low-complexity, no user interaction, integrity-only impact (High), with no confidentiality or availability effect. This is a genuine business-logic/fraud priority rather than an inflated high-CVSS finding - the attacker needs only one valid paid Mollie payment ID (obtainable from their own legitimate purchase) to fraudulently satisfy other orders, producing direct monetary loss. No EPSS score was provided, so statistical exploitation probability cannot be quantified. It is not listed in CISA KEV and no POC is referenced, so there is no evidence of active exploitation; risk is driven by the low technical barrier and clear financial incentive, not observed in-the-wild activity. One caveat: the CVSS records no confidentiality impact, but the accompanying orderId->orderToken hardening implies a secondary order-enumeration/exposure weakness the single 7.5 score does not fully capture. |
| Exploit ScenarioDerived | An attacker makes one small legitimate purchase through a Sylius shop and captures the resulting valid paid Mollie payment id. They then send a crafted POST to /{_locale}/update-payment supplying that payment id together with a victim's (or their own unpaid high-value) orderId, and because the webhook never checks that the payment belongs to that order, the order is flipped to paid with no funds transferred. No public exploit code is identified at time of analysis, but the request is trivial to construct given the low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticated attacker mark any victim order as paid without transferring funds. The plugin's POST /{_locale}/update-payment webhook trusts attacker-supplied id and orderId parameters and never verifies that the referenced Mollie payment belongs to the referenced Sylius order, so possession of any single valid paid Mollie payment ID is enough to forge a paid status on arbitrary orders. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the root cause is straightforward and the impact is a direct financial-fraud primitive against the shop.
RemediationAI
Vendor-released patch: upgrade to Sylius MolliePlugin 2.2.8 (2.2.x branch), 3.2.4 (3.2.x branch), or 3.3.1 (3.3.x branch) to match your major version, then run yarn install and yarn build because the bundled assets/shop/js/mollie/app.js changed from orderId to orderToken (per UPGRADE-2.2.md). The upstream fixes are in PRs #351, #352, and #354 and commits 01316b3, 153c754, and d1f7753. If you have overridden PageRedirectController, QrCodeAction, or the shop JS, or link to the thank-you/get-code endpoints directly, migrate those callers from ?orderId= to ?orderToken=. If immediate patching is impossible, a targeted compensating control is to restrict the POST /{_locale}/update-payment webhook to Mollie's published source IP ranges (trade-off: does not stop an attacker who already knows a valid payment ID and can reach the endpoint, and may break legitimate callbacks if Mollie's IPs change), and to enforce server-side that a Mollie payment id is bound to its order before applying paid status. See the advisory at https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-rc52-c4hv-w89p.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Sylius is a Symfony-based open-source e-commerce platform; the MolliePlugin (CPE cpe:2.3:a:sylius:mollieplugin) integrates the Mollie payment gateway to handle checkout, QR-code payments, and asynchronous payment-status webhooks. The vulnerability is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the shop payment webhook resolves an order from a client-supplied orderId and applies a payment status derived from a client-supplied Mollie payment id without binding the two together. The fix in PaymentWebhookController adds a check that the stored payment_mollie_id (falling back to the order's MolliePaymentId) equals the incoming Mollie payment id, ignoring mismatches with an HTTP 200. The same PRs also harden the thank-you and QR-code endpoints, replacing guessable integer orderId lookups with the non-guessable orderToken (tokenValue), which had allowed access to arbitrary orders.
Know when Sylius gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Remote unauthenticated webhook with no user interaction gives AV:N/AC:L/PR:N/UI:N; forging paid status corrupts order integrity (I:H) with no confidentiality or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
Executive ViewAI
The Sylius Mollie Plugin contains a payment-authorization bypass vulnerability allowing unauthenticated attackers to mark any customer order as paid without receiving funds. Organizations using affected versions (pre-2.2.8, pre-3.2.4, or pre-3.3.1) face direct financial fraud risk on every transaction. Immediate patching is critical to prevent revenue loss and customer-account compromises.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user acco
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expressio
Sylius is an open source eCommerce platform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable,
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. Rated medium severi
Sylius is an open source eCommerce platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitabl
SyliusGridBundle is a package of generic data grids for Symfony applications. Rated critical severity (CVSS 9.8), this v
Sylius eCommerce Framework is vulnerable to a race condition in promotion and coupon usage limit enforcement, where conc
sylius/paypal-plugin is a paypal plugin for the Sylius development platform. Rated high severity (CVSS 7.5), this vulner
Unauthenticated remote attackers can read unmoderated and rejected product reviews on Sylius storefronts through 2.3.0 b
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentica
Authenticated users in Sylius eCommerce can access sensitive customer data belonging to other users through unvalidated
Exploit-DB