CVE-2026-115937High· 7.5▾ TwilightThe Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together: * commerceTransactionHash — selects which Craft Commerce transaction is completed * id — selects whi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full amount, regardless of how much was actually paid.
craftcms/commerce-mollie >= 2.1.1 < 4.4.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115935High· 8.8Control panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-115938High· 8.8Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-112773High· 8.8Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection
CVE-2026-112771Medium· 6.5Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters
CVE-2026-112772High· 8.8Craft CMS 5.0.0 before 5.11.0 RCE via Asset::getMimeType Transform Injection
CVE-2026-112770High· 8.8Craft CMS before 4.18.8 and 5.11.0 Authenticated RCE via Twig group Filter Array-Callable