CVE-2026-100872
highSylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals a…
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Sylius/Sylius disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/pull/19216 disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/releases/tag/v2.2.9 disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-ove... disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4 134c704f-9b21-4f2e-91b3-4a467353bcc0