Vulnerabilities & PatchesEmerging1 src
CVE-2026-53638 - Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
CVE ID : CVE-2026-53638
Published : Sept. 8, 2026, 11:17 p. m.
• 1 hour, 33 minutes ago
Description : Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2. 0. 0 and prior to version 2. 0. 18, 2. 1. 15, and 2. 2. 6, an authorization bypass vulnerability exists in the shop account API.
The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel.
The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`.
