CVE-2026-100872— Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Quick assessment
Affected
Sylius Sylius
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sylius 2.1.16 及 2.2.9 之前的版本在购物车重新计算过程中未能正确验证支付金额，使得未经身份验证的攻击者能够在支付网关交易发起后篡改订单总额。攻击者可以先支付一小部分金额，然后在支付网关捕获（扣款）后扩大订单金额，而系统会将该被虚增的订单标记为“已全额支付”，尽管支付网关实际仅扣除了原始较小的金额。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-100872
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
Source: CVE Program / CVE List V5
Vulnerability Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-100872
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-100872
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-100872 (1)
Vendor Pages for CVE-2026-100872 (1)
Other References for CVE-2026-100872 (4)
-
-
https://github.com/Sylius/Sylius/releases/tag/v2.2.9 release-notes
Same Patch Batch · Sylius · 2026-09-27 · 4 CVEs total
| CVE-2026-100871 | 8.8 HIGH | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows A |
| CVE-2026-100870 | 8.8 HIGH | Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning |
| CVE-2026-100869 | 5.9 MEDIUM | Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API |
IV. Related Vulnerabilities
Same product: Sylius
-
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 J -
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o -
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on s
Same vendor: Sylius
-
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 J -
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o -
CVE-2026-53638
Sylius: Channel-based payment method restriction bypass on s
Same weakness: CWE-345
-
CVE-2026-92161
FriendsOfFlarum OAuth: Unauthenticated account takeover via -
CVE-2026-81630
Botslab G980H Dashcams Insufficient Verification of Data Aut -
CVE-2026-28324
SolarWinds Observability Self-Hosted Remote Code Execution V -
CVE-2026-49450
Joplin desktop Windows auto-updater accepts signed installer -
CVE-2026-63405
AnyCable: Pusher REST API Does Not Verify Request Body MD5 E
V. Comments for CVE-2026-100872
No comments yet