CVE-2026-115937— Unauthenticated payment reuse allows unpaid orders to be marked as paid
Quick assessment
Affected
craftcms commerce-mollie
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mollie 的 Webhook 端点接受两个相互独立且由攻击者控制的参数，却从未验证这两个参数是否属于同一笔交易： ：用于选择要完成的 Craft Commerce 交易。 ：用于选择要查询其状态的 Mollie 支付记录。 任何持有商户账户中任意已支付 Mollie 支付 ID 的未认证攻击者，都可以将该支付 ID 与任意交易哈希值进行配对。 Craft Commerce 会向 Mollie 发起查询，看到状态为“已支付”（ ），随后便会将目标交易标记为成功，并全额确认该交易的金额，而完全无视实际支付的金额是多
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-115937
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated payment reuse allows unpaid orders to be marked as paid
Source: CVE Program / CVE List V5
Vulnerability Description
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
* commerceTransactionHash — selects which Craft Commerce transaction is completed
* id — selects which Mollie payment is queried for its status
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full
amount, regardless of how much was actually paid.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| craftcms | commerce-mollie | 2.1.1 ~ 4.4.3 | - |
|
II. Public POCs for CVE-2026-115937
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-115937
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-115937 (2)
-
-
🔗 Unauthenticated payment reuse allows unpaid orders to be marked as paid | Hackrate third-party-advisory technical-description mitigation
Vendor Pages for CVE-2026-115937 (2)
-
🔗 Release 4.4.3 · craftcms/commerce-mollie · GitHub release-notes
-
Same Patch Batch · craftcms · 2026-10-23 · 3 CVEs total
| CVE-2026-115935 | 8.8 HIGH | Control panel only API response emulation replaces "securityKey" and reaches server RCE |
| CVE-2026-115938 | 8.8 HIGH | Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RC |
IV. Related Vulnerabilities
Same vendor: craftcms
-
CVE-2026-115938
Low privilege condition filter escapes Twig sandbox, recover -
CVE-2026-115935
Control panel only API response emulation replaces "security -
CVE-2026-112777
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist B -
CVE-2026-112776
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via -
CVE-2026-112774
Craft CMS 5.8.0 before 5.11.0 Admin RCE via ContentBlock Fie
Same weakness: CWE-345
-
CVE-2026-56832
PraisonAI DiscordApproval accepts unrelated channel messages -
CVE-2026-114050
vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal -
CVE-2026-112939
filelock: SoftFileLock removes a live holder's marker when a -
CVE-2026-112265
LangBot through 4.11.0 Missing Lark/Feishu Webhook Authentic -
CVE-2026-112161
Lack of integrity checks in Mobatek’s MobaXterm
V. Comments for CVE-2026-115937
No comments yet