Authorization Bypass in Sylius eCommerce Framework
CVE-2026-53638
What is CVE-2026-53638?
An authorization bypass vulnerability exists in the shop account API of Sylius eCommerce Framework that allows authenticated customers to change the payment method of their orders. This occurs through the PATCH /api/v2/shop/account/orders/{tokenValue}/payments/{paymentId} endpoint, which fails to verify whether the selected payment method is enabled for the respective order's channel. Unlike the corresponding checkout endpoint, which correctly denies out-of-channel payment methods, this API endpoint mistakenly returns an HTTP 200 response, enabling unauthorized assignment of payment methods. The issue is addressed in versions 2.0.18, 2.1.15, and 2.2.6 and above. As a temporary measure, developers can also decorate the PaymentMethodChangerInterface service in their application.
Affected Version(s)
Sylius >= 2.0.0, < 2.0.18 < 2.0.0, 2.0.18
Sylius >= 2.1.0, < 2.1.15 < 2.1.0, 2.1.15
Sylius >= 2.2.0, < 2.2.6 < 2.2.0, 2.2.6