CVE-2026-100869CWE-863broken-access-control

CVE-2026-100869

Medium · published September 27, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-27T17:16Z
References (6)
https://github.com/Sylius/Sylius · [email protected]https://github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75d · [email protected]https://github.com/Sylius/Sylius/pull/19214 · [email protected]https://github.com/Sylius/Sylius/releases/tag/v2.2.9 · [email protected]https://github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxf · [email protected]https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-api · [email protected]
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 13:09Z
    Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
    cvelistv5