CVE-2026-100872CWE-345

CVE-2026-100872

High · published September 27, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
7.2
In the wild
Unconfirmed
What it is

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00180 · 7.2th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-09-27T17:16Z
References (7)
https://github.com/Sylius/Sylius · [email protected]https://github.com/Sylius/Sylius/commit/9e9aeaacbc97b1fc01d573e44d6679194527905d · [email protected]https://github.com/Sylius/Sylius/pull/19216 · [email protected]https://github.com/Sylius/Sylius/releases/tag/v2.2.9 · [email protected]https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4 · [email protected]https://www.vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-payment-amount-overwrite · [email protected]https://github.com/Sylius/Sylius/security/advisories/GHSA-vv4h-q2x8-74g4 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 13:09Z
    Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
    cvelistv5