---
id: CVE-2026-68501
title: >-
  Sylius Mollie Plugin provides Mollie payment integration for Sylius
  applications
summary: >-
  Sylius Mollie Plugin provides Mollie payment integration for Sylius
  applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET
  /{_locale}/thank-you PageRedirectController::thankYouAction and GET
  /{_locale}/get-code QrCode…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cwe:
  - CWE-639
vendor: sylius
product: sylius/mollie-plugin
affected:
  - sylius/mollie-plugin < 2.2.8
  - 'sylius/mollie-plugin >= 3.0.0, < 3.2.4'
  - 'sylius/mollie-plugin >= 3.3.0, < 3.3.1'
patched:
  - sylius/mollie-plugin 2.2.8
  - sylius/mollie-plugin 3.2.4
  - sylius/mollie-plugin 3.3.1
published: '2026-07-30'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:12:43.783'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68501'
references:
  - url: >-
      https://github.com/Sylius/MolliePlugin/commit/01316b3ad3cf82e3c5ad160115d0a2cf89174e49
    label: security-advisories@github.com
  - url: >-
      https://github.com/Sylius/MolliePlugin/commit/153c754486b1bc597b67a90ac07ef71cd7958267
    label: security-advisories@github.com
  - url: >-
      https://github.com/Sylius/MolliePlugin/commit/d1f7753e92106e8bf3bedcfc61b02ea7b8e1c38a
    label: security-advisories@github.com
  - url: 'https://github.com/Sylius/MolliePlugin/pull/351'
    label: security-advisories@github.com
  - url: 'https://github.com/Sylius/MolliePlugin/pull/352'
    label: security-advisories@github.com
  - url: 'https://github.com/Sylius/MolliePlugin/pull/354'
    label: security-advisories@github.com
  - url: 'https://github.com/Sylius/MolliePlugin/releases/tag/v2.2.8'
    label: security-advisories@github.com
  - url: 'https://github.com/Sylius/MolliePlugin/releases/tag/v3.2.4'
    label: security-advisories@github.com
  - url: 'https://github.com/Sylius/MolliePlugin/releases/tag/v3.3.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh
    label: security-advisories@github.com
  - url: >-
      https://github.com/Sylius/MolliePlugin/security/advisories/GHSA-x83g-979r-f5fh
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-68501'
  - url: 'https://github.com/advisories/GHSA-x83g-979r-f5fh'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00599
epssPercentile: 0.46365
aliases:
  - GHSA-x83g-979r-f5fh
ecosystem: composer
ingestedAt: '2026-07-31T16:59:59.802Z'
---

## Overview

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-68501)

Affected packages:

- `sylius/mollie-plugin < 2.2.8`
- `sylius/mollie-plugin >= 3.0.0, < 3.2.4`
- `sylius/mollie-plugin >= 3.3.0, < 3.3.1`

Patched in:

- `sylius/mollie-plugin 2.2.8`
- `sylius/mollie-plugin 3.2.4`
- `sylius/mollie-plugin 3.3.1`

Source: https://github.com/advisories/GHSA-x83g-979r-f5fh