{"id":"CVE-2026-53639","title":"Sylius is an Open Source eCommerce Framework on Symfony","summary":"Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints lo…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","cwe":["CWE-639"],"vendor":"Sylius","product":"Sylius","affected":["Sylius >= 2.0.0, < 2.0.18","Sylius >= 2.1.0, < 2.1.15","Sylius >= 2.2.0, < 2.2.6"],"patched":["sylius/sylius 2.0.18","sylius/sylius 2.1.15","sylius/sylius 2.2.6"],"published":"2026-09-08","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:04:42.813","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53639","references":[{"url":"https://github.com/Sylius/Sylius/security/advisories/GHSA-mr9r-h354-966r","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-mr9r-h354-966r"}],"tags":["nvd","cve.org","ghsa","composer"],"epss":0.00543,"epssPercentile":0.43159,"aliases":["GHSA-mr9r-h354-966r"],"ecosystem":"composer","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:49:53.266588Z"},"cvssSource":"cna","ingestedAt":"2026-07-09T21:52:34.645Z","slug":"CVE-2026-53639","body":"## Overview\n\nSylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e.g. `target_path`, `after_path`). These fields are used by the front-end controller to redirect the user after the payment, so an attacker can flip them to an attacker-controlled URL and intercept the buyer. The hash is a UUID, so it has to be obtained out-of-band (logs, shared links, referrer headers, a co-located client), but once it is known no other credential is required, neither authentication nor knowledge of the order token. The creation endpoint `POST /api/v2/shop/orders/{tokenValue}/payment-requests` shares the same flaw: it resolves the target order solely from the `tokenValue` in the URL without verifying that the caller owns the order. The issue is fixed in versions 2.0.18, 2.1.15, and 2.2.6. As a workaround, add a query extension that filters the `GET` operation; decorate the `PUT` state provider, guard the `POST` creation endpoint with a command-bus middleware, and wire the services.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-53639)\n\nAffected packages:\n\n- `sylius/sylius >= 2.0.0, < 2.0.18`\n- `sylius/sylius >= 2.1.0, < 2.1.15`\n- `sylius/sylius >= 2.2.0, < 2.2.6`\n\nPatched in:\n\n- `sylius/sylius 2.0.18`\n- `sylius/sylius 2.1.15`\n- `sylius/sylius 2.2.6`\n\nSource: https://github.com/advisories/GHSA-mr9r-h354-966r","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8191,"id":"CVE-2026-53639","ts":1788919973154,"field":"cvss","old":null,"new":"6.3"},{"seq":8000,"id":"CVE-2026-53639","ts":1788919275571,"field":"cvss","old":"6.3","new":null},{"seq":7809,"id":"CVE-2026-53639","ts":1788916333762,"field":"cvss","old":null,"new":"6.3"},{"seq":7618,"id":"CVE-2026-53639","ts":1788915291807,"field":"cvss","old":"6.3","new":null},{"seq":7427,"id":"CVE-2026-53639","ts":1788912695001,"field":"cvss","old":null,"new":"6.3"},{"seq":7236,"id":"CVE-2026-53639","ts":1788911324099,"field":"cvss","old":"6.3","new":null},{"seq":7200,"id":"CVE-2026-53639","ts":1788909268855,"field":"cvss","old":null,"new":"6.3"}]}