Webhook Vulnerability in Craft Commerce by Mollie

CVE-2026-115937

What is CVE-2026-115937?

A serious vulnerability exists within the Craft Commerce payment processing system, specifically in the Mollie webhook endpoint. This endpoint accepts two separate parameters controlled by an attacker: the commerceTransactionHash, which determines which transaction to mark as completed, and the id, which identifies the Mollie payment for status querying. An attacker can exploit this flaw without authentication by correlating any valid paid Mollie payment ID from the merchant's account with any transaction hash. This manipulation allows the attacker to exploit the system, as the commerce system may misinterpret the payment as fully successful, regardless of the actual transaction amount paid. Precautions and proper validation measures are crucial to prevent unauthorized transaction approvals.

References