CVE-2026-100869GHSA-2rv4-pjmm-7fxf
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
Sylius Sylius
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 17% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.
Text from CVE List
Affected versions 2
- Syliusaffected: 2.0.0 before 2.1.16CVE List
- Syliusaffected: 2.2.0 before 2.2.9CVE List
References 6
- github.com/Sylius/Sylius/pull/19214Fixvia CVE List
- github.com/Sylius/Sylius/commit/5813831f60f3a60b735a86a57c4b519626a3b75dFixvia CVE List
- github.com/Sylius/Sylius/releases/tag/v2.2.9Fixvia CVE List
- github.com/Sylius/Sylius/security/advisories/GHSA-2rv4-pjmm-7fxfAdvisoryvia CVE List
- vulncheck.com/advisories/sylius-2-x-before-2.1.16-and-2.2.9-arbitrary-payment-action-via-shop-apiAdvisoryvia CVE List
- github.com/Sylius/SyliusReferencevia CVE List