EUVD-2026-51301
GHSA-x83g-979r-f5fh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Network-accessible IDOR with no auth required; only confidentiality impact (PII names/emails) documented - A:L in the official vector is unsupported by the description or code evidence.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.
AnalysisAI
Sequential integer order ID enumeration in Sylius MolliePlugin exposes customer PII across all orders without authentication. The thank-you and QR-code endpoints accept a raw integer orderId query parameter with no ownership or session validation, allowing unauthenticated remote attackers to iterate through all orders, extract non-guessable tokenValue identifiers, and subsequently query the register-after-checkout endpoint to retrieve customer first names, last names, and email addresses. No active exploitation confirmed (not in CISA KEV) and no public proof-of-concept exploit has been identified, but the attack requires zero authentication and minimal skill, making it a realistic threat to any publicly-facing Sylius shop using the Mollie payment gateway.
Technical ContextAI
The vulnerability is a classic Insecure Direct Object Reference (CWE-639), a subclass of broken object-level authorization. The affected plugin (CPE: cpe:2.3:a:sylius:mollieplugin:*:*:*:*:*:*:*:*) is a Symfony-based PHP plugin integrating the Mollie payment gateway into Sylius e-commerce applications. The root cause is the use of auto-incremented integer order IDs as URL/query parameters in two unauthenticated endpoints: PageRedirectController::thankYouAction (GET /{_locale}/thank-you?orderId=N) and QrCodeAction::fetchQrCodeFromOrder (GET /{_locale}/get-code?orderId=N). Because database auto-increment IDs are sequential and predictable, attackers can trivially enumerate them. The leaked tokenValue from these endpoints is then accepted by the GET /{_locale}/register-after-checkout/{tokenValue} endpoint, which discloses customer PII. The fix - confirmed by GitHub PRs #351, #352, and #354 - replaces the guessable integer orderId with the order's non-guessable orderToken (tokenValue) in both parameters and enforces session-cart ownership checks in the QR-code action.
RemediationAI
Upgrade Sylius MolliePlugin to the patched releases: v2.2.8 (https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8), v3.2.4 (https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4), or v3.3.1 (https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1). After upgrading, run 'yarn install' and 'yarn build' to rebuild frontend assets, as app.js was updated to use the orderToken parameter instead of orderId. If you have overridden assets/shop/js/mollie/app.js or link to these endpoints directly, update all references from ?orderId= to ?orderToken= as described in UPGRADE-2.2.md. If an immediate upgrade is not possible, a compensating control is to block external access to the /{_locale}/thank-you, /{_locale}/get-code, and /{_locale}/register-after-checkout/{tokenValue} endpoints at the web server or WAF layer, though this will break the post-checkout Mollie payment flow for legitimate customers and should only be a temporary measure. The full fix is detailed in the GitHub security advisory at https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh.
A rate limiting issue in Sylius v2.0.2 allows a remote attacker to perform unrestricted brute-force attacks on user acco
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, request parameters injected inside an expression
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expressio
Sylius is an open source eCommerce platform. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable,
Sylius 1.12.13 is vulnerable to Cross Site Scripting (XSS) via the "Province" field in Address Book. Rated medium severi
Sylius is an open source eCommerce platform. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitabl
SyliusGridBundle is a package of generic data grids for Symfony applications. Rated critical severity (CVSS 9.8), this v
Sylius eCommerce Framework is vulnerable to a race condition in promotion and coupon usage limit enforcement, where conc
Payment-authorization bypass in the Sylius Mollie Plugin (versions before 2.2.8, 3.2.4, and 3.3.1) lets an unauthenticat
sylius/paypal-plugin is a paypal plugin for the Sylius development platform. Rated high severity (CVSS 7.5), this vulner
Authenticated users in Sylius eCommerce can access sensitive customer data belonging to other users through unvalidated
Open redirect vulnerabilities in Sylius eCommerce Framework allow unauthenticated attackers to redirect users to arbitra
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today