CVE-2026-100869
Received Received - Intake

Sylius Shop API Payment Action Bypass

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100869
EUVD
EUVD-2026-87941

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
sylius sylius From 2.0.0 (inc) to 2.1.16 (exc)
sylius sylius From 2.2.0 (inc) to 2.2.9 (exc)
sylius sylius 2.1.16
sylius sylius 2.2.9
sylius sylius to 2.1.16 (exc)
sylius sylius to 2.2.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Sylius versions before 2.1.16 and 2.2.9. It allows attackers with order tokens to submit arbitrary payment actions like refunds via the Shop API endpoint. The system fails to restrict these actions, so payment gateways process refunds while Sylius still marks orders as paid, causing financial loss for merchants.

Detection Guidance

To detect this vulnerability, check if your Sylius installation is running a vulnerable version (2.0.0 to <2.1.16 or 2.2.0 to <2.2.9). Inspect API logs for POST requests to /api/v2/shop/orders/{tokenValue}/payment-requests with action=refund or other unauthorized actions. Use commands like curl to test the endpoint: curl -X POST -H 'Content-Type: application/json' -d '{"action":"refund"}' https://yourdomain.com/api/v2/shop/orders/{tokenValue}/payment-requests. If the request succeeds, the system is vulnerable.

Impact Analysis

If you are a merchant using an affected Sylius version, attackers could exploit this to trigger unauthorized refunds on completed orders. This leads to financial losses as you fulfill orders while customers receive refunds. The vulnerability requires only an order token and a payment gateway configured to support refunds.

Compliance Impact

This vulnerability could lead to financial losses for merchants due to unauthorized refunds, which may violate financial compliance requirements under standards like PCI DSS. It does not directly impact GDPR or HIPAA compliance unless financial data breaches occur as a secondary effect.

Mitigation Strategies

Immediately upgrade Sylius to version 2.1.16 or 2.2.9 or later. If upgrading is not possible, restrict the PaymentRequest actions by configuring the allowlist in sylius_api.shop_payment_request.allowed_actions to only permit capture, authorize, status, and notify. Alternatively, implement a kernel event listener to block unauthorized actions on the endpoint as a temporary workaround.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100869. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart