Authorization Bypass in Sylius API Affects Product Reviews
CVE-2026-108724

6.9MEDIUM

Key Information:

Vendor

Sylius

Status
Sylius
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108724?

Sylius versions up to 2.3.0 contain a vulnerability that permits unauthenticated users to access unmoderated and rejected product reviews. This occurs because the AcceptedExtension filter is not applied to item operations. By exploiting this gap, attackers can enumerate review IDs via the API endpoint GET /api/v2/shop/product-reviews/{id}. This enables them to retrieve sensitive information including review titles, ratings, comments, timestamps, and the first names of authors, effectively bypassing merchant moderation mechanisms.

Affected Version(s)

Sylius 0 <= 2.3.0

References

https://hackmd.io/@haind/sylius-shop-product-review-item-...
third-party-advisory
https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f1...
technical-description
https://github.com/Sylius/Sylius/blob/34fc73a9ee89e8cd3f1...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.