Vulnerability in Sylius eCommerce Framework Allows Cart Manipulation by Unauthorized Users
CVE-2026-31821

6.9MEDIUM

Key Information:

Vendor

Sylius

Status
Sylius
Vendor
CVE Published:
10 March 2026

What is CVE-2026-31821?

The Sylius eCommerce Framework has a vulnerability in the POST /api/v2/shop/orders/{tokenValue}/items endpoint that fails to verify the ownership of shopping carts. This flaw allows a malicious actor to exploit the cart tokenValue and add items to another registered customer's cart without authentication. Upon obtaining the cart tokenValue, the attacker can manipulate the content of another user’s cart, potentially leading to unauthorized purchases or other disruptive actions. This issue has been addressed in recent updates, including versions 2.0.16, 2.1.12, and 2.2.3.

Affected Version(s)

Sylius >= 2.2.0, < 2.2.3 < 2.2.0, 2.2.3

Sylius >= 2.1.0, < 2.1.12 < 2.1.0, 2.1.12

Sylius >= 2.0.0, < 2.0.16 < 2.0.0, 2.0.16

References

https://github.com/Sylius/Sylius/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.