CVE-2026-108724
Received Received - Intake

Unauthenticated Review Data Exposure in Sylius

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequential ids on GET /api/v2/shop/product-reviews/{id} to retrieve review titles, ratings, comments, timestamps and author first names, bypassing merchant moderation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108724
EUVD
EUVD-2026-96890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sylius Sylius 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in Sylius versions up to 2.3.0. It allows unauthenticated attackers to read unmoderated and rejected product reviews by exploiting a missing filter (AcceptedExtension) on the GET /api/v2/shop/product-reviews/{id} endpoint. Attackers can guess sequential IDs to access review details like titles, ratings, comments, timestamps, and author names without proper authorization.

Detection Guidance

To detect this vulnerability, check if your Sylius installation allows unauthenticated access to GET /api/v2/shop/product-reviews/{id} endpoints. Test by sending requests to sequential IDs and verify if unmoderated or rejected reviews are exposed without authentication.

Impact Analysis

If you use Sylius versions up to 2.3.0, attackers could access sensitive review data, including customer feedback and personal details like first names. This could lead to privacy breaches, reputational damage, or exposure of confidential business information. The vulnerability enables enumeration of reviews without authentication.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data (e.g., customer names, review content) without consent. For HIPAA, if reviews contain health-related information, unauthorized access could breach patient privacy. Compliance risks include fines, legal action, and loss of trust due to unauthorized data exposure.

Mitigation Strategies

Immediately update Sylius to version 2.3.0 or later to patch the authorization bypass. If an update is not possible, restrict access to the /api/v2/shop/product-reviews/{id} endpoint via firewall rules or API gateway configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108724. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart