{"id":"CVE-2026-68501","title":"Sylius Mollie Plugin provides Mollie payment integration for Sylius applications","summary":"Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCode…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","cwe":["CWE-639"],"vendor":"sylius","product":"sylius/mollie-plugin","affected":["sylius/mollie-plugin < 2.2.8","sylius/mollie-plugin >= 3.0.0, < 3.2.4","sylius/mollie-plugin >= 3.3.0, < 3.3.1"],"patched":["sylius/mollie-plugin 2.2.8","sylius/mollie-plugin 3.2.4","sylius/mollie-plugin 3.3.1"],"published":"2026-07-30","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:12:43.783","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68501","references":[{"url":"https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/pull/351","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/pull/352","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/pull/354","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh","label":"security-advisories@github.com"},{"url":"https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68501"},{"url":"https://github.com/advisories/GHSA-x83g-979r-f5fh"}],"tags":["nvd","ghsa","composer"],"epss":0.00429,"epssPercentile":0.36612,"aliases":["GHSA-x83g-979r-f5fh"],"ecosystem":"composer","ingestedAt":"2026-07-31T16:59:59.802Z","slug":"CVE-2026-68501","body":"## Overview\n\nSylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-68501)\n\nAffected packages:\n\n- `sylius/mollie-plugin < 2.2.8`\n- `sylius/mollie-plugin >= 3.0.0, < 3.2.4`\n- `sylius/mollie-plugin >= 3.3.0, < 3.3.1`\n\nPatched in:\n\n- `sylius/mollie-plugin 2.2.8`\n- `sylius/mollie-plugin 3.2.4`\n- `sylius/mollie-plugin 3.3.1`\n\nSource: https://github.com/advisories/GHSA-x83g-979r-f5fh","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}