CVE-2026-100869— Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
Quick assessment
Affected
Sylius Sylius
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sylius 在 2.1.16 及 2.2.9 之前的版本中存在一个缺陷，未能正确限制商店 API 端点中的支付请求操作。攻击者可以利用此漏洞，在订单已完成的情况下触发退款操作。由于攻击者持有有效的订单令牌，他们可以提交任意的支付操作（例如退款），支付网关会执行这些操作，但 Sylius 仍会将订单状态保持为“已支付”。这种行为可能导致用户遭受财务损失。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100869
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
Source: CVE Program / CVE List V5
Vulnerability Description
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100869
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100869
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100869 (1)
Vendor Pages for CVE-2026-100869 (1)
Other References for CVE-2026-100869 (4)
-
-
https://github.com/Sylius/Sylius/releases/tag/v2.2.9 release-notes
Same Patch Batch · Sylius · 2026-09-27 · 4 CVEs total
| CVE-2026-100871 | 8.8 HIGH | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows A |
| CVE-2026-100870 | 8.8 HIGH | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning |
| CVE-2026-100872 | 7.5 HIGH | Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite |
IV. Related Vulnerabilities
Same product: Sylius
-
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 J -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o -
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on s
Same vendor: Sylius
-
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 J -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o -
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on s
Same weakness: CWE-863
-
CVE-2026-97335
Incorrect authorization in LXD storage volume API allows rea -
CVE-2026-19759
Incorrect Authorization in Application Integration allows In -
CVE-2026-82378
Apache Roller: OAuth authorization endpoint trusts request-s -
CVE-2026-101006
Frappe HR Permission Validation __init__.py get_attendance_r -
CVE-2026-101062
Obot before v0.23.0 Authentication Bypass via OAuth Dynamic
V. Comments for CVE-2026-100869
No comments yet