Insecure Direct Object Reference Vulnerability in Sylius eCommerce Framework
CVE-2026-31820

7.1HIGH

Key Information:

Vendor

Sylius

Status
Sylius
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31820?

The Sylius eCommerce Framework contains an Insecure Direct Object Reference (IDOR) vulnerability in its LiveComponents. This issue arises from unvalidated resource IDs that are accepted via the #[LiveArg] parameters, allowing attackers to access another user's personal information, such as names, addresses, and phone numbers. Specific components, including the Checkout address FormComponent and Cart WidgetComponent, are susceptible as they load resource IDs directly without verifying user ownership. Consequently, this exposes sensitive data, including order details and shipping information, leading to potential data breaches. Users are advised to upgrade to the latest versions—2.0.16, 2.1.12, or 2.2.3 and above—to mitigate this vulnerability.

Affected Version(s)

Sylius >= 2.2.0, < 2.2.3 < 2.2.0, 2.2.3

Sylius >= 2.1.0, < 2.1.12 < 2.1.0, 2.1.12

Sylius >= 2.0.0, < 2.0.16 < 2.0.0, 2.0.16

References

https://github.com/Sylius/Sylius/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.