CVE-2026-100872
Received Received - Intake

Unauthenticated Payment Amount Manipulation in Sylius

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark the inflated order as fully paid while the gateway captured only the original amount.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100872
EUVD
EUVD-2026-87944

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
sylius sylius From 2.0.0 (inc) to 2.1.16 (exc)
sylius sylius From 2.2.0 (inc) to 2.2.9 (exc)
sylius sylius to 2.1.16 (exc)
sylius sylius to 2.2.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Sylius versions before 2.1.16 and 2.2.9. It allows unauthenticated attackers to manipulate order totals after initiating a payment gateway transaction. Attackers can pay a small amount, then increase the order total while the gateway only captures the original smaller amount. The system may incorrectly mark the inflated order as fully paid.

Detection Guidance

To detect this vulnerability, check if your Sylius installation is running an affected version (2.0.0 to <2.1.16 or 2.2.0 to <2.2.9). Review payment logs for transactions where the order total was modified after payment initiation. Look for discrepancies between captured payment amounts and order totals.

Impact Analysis

Unauthenticated attackers could exploit this to pay less than the actual order total while having the system record the full amount as paid. This results in financial loss for merchants as the payment gateway captures only the smaller amount. The vulnerability also allows attackers to inflate order totals after payment initiation, leading to incorrect financial records.

Compliance Impact

This vulnerability could lead to financial misreporting and unauthorized transactions, potentially violating compliance requirements for accurate financial records. It may also expose merchants to legal liabilities and regulatory penalties due to improper payment processing and data integrity issues.

Mitigation Strategies
  • Upgrade Sylius to version 2.1.16 or 2.2.9 or later to apply the official patch.
  • Implement a temporary workaround by decorating affected services to prevent modifications to payments already claimed by a gateway.
  • Monitor payment transactions for unauthorized order total changes after payment initiation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100872. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart