CVE-2026-53638 - Sylius: Channel-based payment method restriction bypass on shop account orders API endpoint
Brief
CVE ID : CVE-2026-53638
Published : Sept. 8, 2026, 11:17 p. m.
- 1 hour, 33 minutes ago
Description : Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.
- 0 and prior to version 2.
- 18, 2.
- 15, and 2.
- 6, an authorization bypass vulnerability exists in the shop account API.
The `PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId}` endpoint, used by an authenticated shop customer to change the payment method of an order that has been placed but not yet paid (state `STATE_NEW`), does not validate that the chosen payment method is enabled for the order's channel.
The equivalent checkout endpoint (`PATCH /api/v2/shop/orders/{tokenValue}/payments/{paymentId}`) correctly rejects out-of-channel payment methods with `HTTP 422`; the account endpoint silently accepts them and returns `HTTP 200`.