CVE-2026-108724
mediumSylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews beca…
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/Sylius/Sylius disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/... disclosure@vulncheck.com
- https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f11aa81d0b18ee91f25e8d7/src/Sylius/... disclosure@vulncheck.com
- https://hackmd.io/@haind/sylius-shop-product-review-item-moderation-bypass disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/sylius-through-2.3.0-authorization-bypass-via-shop-ap... disclosure@vulncheck.com