CVE-2026-68501
Received Received - Intake

Stored XSS in Sylius Mollie Plugin via Order Token Exposure

Publication date: 2026-07-30

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-68501
EUVD
EUVD-2026-51301

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
sylius mollie_plugin to 2.2.8 (inc)
sylius mollie_plugin to 3.2.4 (inc)
sylius mollie_plugin to 3.3.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Sylius Mollie Plugin versions before 2.2.8, 3.2.4, and 3.3.1. It allows unauthorized access to customer order details by exploiting sequential order IDs without proper ownership or session checks. Attackers can retrieve order tokens and use them to view customer first name, last name, and email via specific endpoints.

Detection Guidance

The vulnerability involves exposed order token values due to missing ownership or session checks in specific endpoints. To detect it, inspect web server logs for unusual GET requests to /{_locale}/thank-you, /{_locale}/get-code, or /{_locale}/register-after-checkout/{tokenValue} endpoints. Look for sequential orderId values or repeated access to these paths without valid sessions.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized access to customer personal data such as names and email addresses. This may result in privacy breaches, reputational damage, and potential legal consequences for businesses using the affected plugin versions.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by exposing personally identifiable information (PII) without consent. Organizations may face fines, legal actions, and mandatory breach notifications if customer data is compromised due to this issue.

Mitigation Strategies

Immediately update the Sylius Mollie Plugin to versions 2.2.8, 3.2.4, or 3.3.1 or later. If immediate update is not possible, restrict access to the vulnerable endpoints via web server rules or firewall. Review logs for potential exploitation and invalidate any exposed tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68501. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart