CVE-2026-68500

Received Received - Intake

Payment Validation Bypass in Sylius Mollie Plugin

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-68500

EUVD

EUVD-2026-51299

Affected Vendors & Products

Vendor	Product	Version / Range
sylius	mollie_plugin	2.2.8
sylius	mollie_plugin	3.2.4
sylius	mollie_plugin	3.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Sylius Mollie Plugin, which integrates Mollie payment services with Sylius applications. The issue is in the payment webhook endpoint that processes updates for payments. An attacker can exploit this by providing manipulated payment and order IDs without verifying ownership, allowing them to mark an order as paid without actually transferring funds.

Detection Guidance

To detect this vulnerability, check if your Sylius Mollie Plugin version is below 2.2.8, 3.2.4, or 3.3.1. Inspect webhook logs for POST requests to /{_locale}/update-payment with mismatched id and orderId parameters. Verify if any orders were marked as paid without corresponding Mollie payment transfers.

Impact Analysis

If you use the Sylius Mollie Plugin versions prior to 2.2.8, 3.2.4, or 3.3.1, an unauthenticated attacker could trick the system into marking orders as paid without receiving payment. This could lead to financial losses as orders appear completed but no funds are transferred.

Compliance Impact

This vulnerability could lead to unauthorized order status changes without actual payment, potentially violating data integrity and financial transaction accuracy requirements in GDPR and HIPAA. Unauthorized modifications to order states may compromise audit trails and financial record-keeping, which are critical for compliance.

Mitigation Strategies

Immediately update the Sylius Mollie Plugin to versions 2.2.8, 3.2.4, or 3.3.1 or later to patch the vulnerability. Review webhook logs for suspicious POST /{_locale}/update-payment requests with mismatched id and orderId parameters.

Hi! I’m here to help you understand CVE-2026-68500. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70