---
id: CVE-2026-108724
title: >-
  Sylius through 2.3.0 contains an authorization bypass vulnerability that
  allows unauthenticated attackers to read unmoderated and rejected product
  reviews because the AcceptedExtension filter is not applied to the item
  operation
summary: >-
  Sylius through 2.3.0 contains an authorization bypass vulnerability that
  allows unauthenticated attackers to read unmoderated and rejected product
  reviews because the AcceptedExtension filter is not applied to the item
  operation. Attacke…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T13:17:16.000'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108724'
references:
  - url: 'https://github.com/Sylius/Sylius'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Doctrine/ORM/QueryExtension/Shop/ProductReview/AcceptedExtension.php#L25-L59
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/Bundle/ApiBundle/Resources/config/services/extensions.php#L63-L67
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind/sylius-shop-product-review-item-moderation-bypass'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/sylius-through-2.3.0-authorization-bypass-via-shop-api-product-review-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-11T13:51:17.028Z'
---

## Overview

Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.