CVE-2026-100872
HIGHCVSS 7.5Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
Timeline
Published:September 27th, 2026 1:16 PM
Last modified:September 28th, 2026 8:57 PM
CVSS Scoring
CVSS v3: 7.5 (HIGH)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/Sylius/Sylius
- https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d
- https://github.com/Sylius/Sylius/pull/19216
- https://github.com/Sylius/Sylius/releases/tag/v2.2.9
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4
- https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-overwrite
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4
Source: NIST NVD · Data may lag official sources by up to one minute