---
id: CVE-2026-53638
title: Sylius is an Open Source eCommerce Framework on Symfony
summary: >-
  Sylius is an Open Source eCommerce Framework on Symfony. Starting in version
  2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass
  vulnerability exists in the shop account API. The `PATCH
  /api/v2/shop/account/orde…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-863
vendor: Sylius
product: Sylius
affected:
  - 'Sylius >= 2.0.0, < 2.0.18'
  - 'Sylius >= 2.1.0, < 2.1.15'
  - 'Sylius >= 2.2.0, < 2.2.6'
patched:
  - sylius/sylius 2.0.18
  - sylius/sylius 2.1.15
  - sylius/sylius 2.2.6
published: '2026-09-08'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T13:18:39.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53638'
references:
  - url: 'https://github.com/Sylius/Sylius/security/advisories/GHSA-6955-hrm5-c4qp'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-6955-hrm5-c4qp'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T12:05:41.264665Z'
epss: 0.00284
epssPercentile: 0.1866
aliases:
  - GHSA-6955-hrm5-c4qp
ecosystem: composer
ingestedAt: '2026-07-09T21:52:34.649Z'
---

## Overview

Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, an authorization bypass vulnerability exists in the shop account API. The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel. The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`. An authenticated customer can therefore assign any globally enabled payment method to their own placed order, including methods that the store operator has explicitly excluded from that channel. The issue is fixed in versions: 2.0.18, 2.1.15, 2.2.6 and above. As a workaround, decorate the `Sylius\Bundle\ApiBundle\Changer\PaymentMethodChangerInterface` service in the application.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53638)

Affected packages:

- `sylius/sylius >= 2.0.0, < 2.0.18`
- `sylius/sylius >= 2.1.0, < 2.1.15`
- `sylius/sylius >= 2.2.0, < 2.2.6`

Patched in:

- `sylius/sylius 2.0.18`
- `sylius/sylius 2.1.15`
- `sylius/sylius 2.2.6`

Source: https://github.com/advisories/GHSA-6955-hrm5-c4qp