CVE-2026-53639 - Sylius: IDOR on Shop Payment Request API endpoints
Brief
CVE ID : CVE-2026-53639
Published : Sept. 8, 2026, 11:17 p. m.
- 1 hour, 33 minutes ago
Description : Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.
- 0 and prior to version 2.
- 18, 2.
- 15, and 2.
- 6, the `GET /api/v2/shop/payment-requests/{hash}` and `PUT /api/v2/shop/payment-requests/{hash}` endpoints look up the payment request solely by the hash from the URL. No ownership check is performed against the authenticated customer or the underlying order.
An attacker who obtains a payment request hash can read the payment request and, through the `payment` IRI in the response, recover the underlying order's `tokenValue` (which itself grants access to the full order, items, addresses, customer email, totals); and/or update the payment request payload (e. g. `target_path`, `after_path`).