Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-68500

Sylius Mollie Plugin: Payment status forgery via the payment webhook

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Sylius MolliePlugin

  • < 2.2.8affected
  • >= 3.0.0, < 3.2.4affected
  • >= 3.3.0, < 3.3.1affected

References