Open Source eCommerce Framework Vulnerability in Sylius by Sylius
CVE-2026-31819

6.9MEDIUM

Key Information:

Vendor

Sylius

Status
Sylius
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31819?

The Sylius eCommerce Framework contains a vulnerability in its CurrencySwitchController, ImpersonateUserController, and StorageBasedLocaleSwitcher components. These components improperly handle the HTTP Referer header during redirects, allowing attackers to exploit this behavior through social engineering. By crafting a legitimate-looking link on a malicious site, attackers can trick users into clicking the link, which redirects them back to the attacker's page, potentially leading to phishing incidents or credential theft. The issue affects both public and admin-only endpoints, with public endpoints being easily exploitable without authentication. Even authenticated admin users can fall victim if they interact with external links. Users are encouraged to update to the latest fixed versions for enhanced security.

Affected Version(s)

Sylius >= 2.2.0, < 2.2.3 < 2.2.0, 2.2.3

Sylius >= 2.1.0, < 2.1.12 < 2.1.0, 2.1.12

Sylius >= 2.0.0, < 2.0.16 < 2.0.0, 2.0.16

References

https://github.com/Sylius/Sylius/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.