CVE-2026-31820— Sylius affected by IDOR in Cart and Checkout LiveComponents
Quick assessment
Affected
Sylius Sylius
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sylius是波兰Sylius公司的一套基于Symfony框架的开源电子商务平台。 Sylius存在安全漏洞，该漏洞源于多个商店LiveComponent中存在未经验证的资源ID，可能导致不安全的直接对象引用攻击。以下版本受到影响：2.0.16之前版本、2.1.12之前版本和2.2.3之前版本。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScript
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-31820
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sylius affected by IDOR in Cart and Checkout LiveComponents
Source: CVE Program / CVE List V5
Vulnerability Description
Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveComponents due to unvalidated resource IDs accepted via #[LiveArg] parameters. Unlike props, which are protected by LiveComponent's @checksum, args are fully user-controlled - any action that accepts a resource ID via #[LiveArg] and loads it with ->find() without ownership validation is vulnerable. Checkout address FormComponent (addressFieldUpdated action): Accepts an addressId via #[LiveArg] and loads it without verifying ownership, exposing another user's first name, last name, company, phone number, street, city, postcode, and country. Cart WidgetComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing order total and item count. Cart SummaryComponent (refreshCart action): Accepts a cartId via #[LiveArg] and loads any order directly from the repository, exposing subtotal, discount, shipping cost, taxes (excluded and included), and order total. Since sylius_order contains both active carts (state=cart) and completed orders (state=new/fulfilled) in the same ID space, the cart IDOR exposes data from all orders, not just active carts. The issue is fixed in versions: 2.0.16, 2.1.12, 2.2.3 and above.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Sylius 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Sylius是波兰Sylius公司的一套基于Symfony框架的开源电子商务平台。 Sylius存在安全漏洞，该漏洞源于多个商店LiveComponent中存在未经验证的资源ID，可能导致不安全的直接对象引用攻击。以下版本受到影响：2.0.16之前版本、2.1.12之前版本和2.2.3之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-31820
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31820
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-31820 (1)
-
IDOR in Cart and Checkout LiveComponents · Advisory · Sylius/Sylius · GitHub x_refsource_CONFIRM
Same Patch Batch · Sylius · 2026-03-10 · 7 CVEs total
| CVE-2026-31824 | 8.2 HIGH | Sylius has a Promotion Usage Limit Bypass via Race Condition |
| CVE-2026-31825 | 5.3 MEDIUM | Sylius has a DQL Injection via API Order Filters |
| CVE-2026-31823 | 4.8 MEDIUM | Sylius has Authenticated Stored XSS |
| CVE-2026-31819 | Sylius has an Open Redirect via Referer Header | |
| CVE-2026-31822 | Sylius has a XSS vulnerability in checkout login form | |
| CVE-2026-31821 | Sylius is Missing Authorization in API v2 Add Item Endpoint |
IV. Related Vulnerabilities
Same product: Sylius
-
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite -
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 J -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o
Same vendor: Sylius
-
CVE-2026-100872
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite -
CVE-2026-100870
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 A -
CVE-2026-100871
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 J -
CVE-2026-100869
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action -
CVE-2026-53637
Sylius: Cart FormComponent allows modification or deletion o
Same weakness: CWE-639
-
CVE-2026-104969
Plane: Cross-Tenant Cycle Issue Hijack via IDOR -
CVE-2026-104967
Plane: Cross-workspace association destruction and issue mut -
CVE-2026-104966
Plane: Cross-Workspace IDOR in Estimate and Comment Endpoint -
CVE-2026-104965
Plane: Cross-Tenant Issue Relation Creation via IDOR -
CVE-2026-104964
Plane: Cross-Workspace Project Modification via Unscoped Pro
V. Comments for CVE-2026-31820
No comments yet