Search

CVE-2026-53639 - Sylius: IDOR on Shop Payment Request API endpoints

CVE ID : CVE-2026-53639 Published : Sept. 8, 2026, 11:17 p. m. • 1 hour, 33 minutes ago Description : Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2. 0. 0 and prior to version 2. 0. 18, 2. 1. 15, and 2. 2. 6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order. An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e. g. `target_path`, `after_path`).